name: CI

on:
  push:
    branches: [develop]
    paths-ignore:
      - ".beans/**"
      - "*.md"
      - "LICENSE"
      - ".gitignore"
      - ".github/workflows/deploy.yml"
  pull_request:
    branches: [develop]
    paths-ignore:
      - ".beans/**"
      - "*.md"
      - "LICENSE"
      - ".gitignore"
      - ".github/workflows/deploy.yml"

jobs:
  backend-lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
        with:
          python-version: "3.14"
      - run: pip install ruff ty
      - name: Check linting
        run: ruff check backend/
      - name: Check formatting
        run: ruff format --check backend/
      - name: Type check
        run: ty check backend/src/
        continue-on-error: true

  actions-lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
        with:
          persist-credentials: false
      - name: Install actionlint
        run: |
          curl -sL https://github.com/rhysd/actionlint/releases/latest/download/actionlint_linux_amd64.tar.gz | tar xz
          sudo mv actionlint /usr/local/bin/
      - name: Lint GitHub Actions
        run: actionlint
      - name: Install zizmor
        run: pip install zizmor
      - name: Audit GitHub Actions security
        run: zizmor .github/workflows/

  frontend-lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
        with:
          node-version: "24"
      - name: Install dependencies
        run: npm ci
        working-directory: frontend
      - name: Lint
        run: npm run lint
        working-directory: frontend
      - name: Check formatting
        run: npx oxfmt --check "src/"
        working-directory: frontend
      - name: Type check
        run: npx tsc -b
        working-directory: frontend