name: "CI: Perf guard"

# Render passes, component renders and JMAP requests per open / search /
# folder switch, against a production build with the dev mock's
# benchmark-sized corpus (scripts/perf-guard). Counts, not timings: they do
# not drift with runner load, so a failure means the code does more work.

on:
  push:
  pull_request:

# The job builds and runs the checked-out code; a compromised step must not
# hold a token that can write to the repository.
permissions:
  contents: read

jobs:
  perf-guard:
    name: Perf guard
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Install Playwright browser
        run: npx playwright install --with-deps chromium

      # The same bundler the Docker image uses, with the dev mock compiled in.
      - name: Build
        env:
          DEV_MOCK_JMAP: "true"
          NEXT_TELEMETRY_DISABLED: "1"
          GIT_COMMIT: ${{ github.sha }}
        run: node scripts/build-plugin-sandbox.mjs && npx next build --webpack

      - name: Run perf guard
        env:
          CI: "true"
        run: npm run test:perf-guard