name: "CI: Unit tests"

on:
  push:
  pull_request:

# The job builds and runs the checked-out code; a compromised step must not
# hold a token that can write to the repository.
permissions:
  contents: read

jobs:
  vitest:
    name: Vitest
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          # Matches the version the standalone release build uses; the repo has
          # no .nvmrc or "engines" field to read it from.
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Run test suite
        # forks + a small worker count keeps the load-sensitive component tests
        # from timing out on the shared runners; the longer per-test timeout
        # covers the jsdom-heavy suites.
        run: npx vitest run --pool=forks --maxWorkers=2 --testTimeout=15000

  # The pre-commit hook lints only staged files and never runs on fork PRs,
  # so this is the one place the whole tree is checked.
  lint:
    name: Lint and typecheck
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Typecheck
        run: npm run typecheck

      - name: Lint
        run: npm run lint