name: CI
on:
  push:
    branches: [main]
  pull_request:
jobs:
  verify:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:17-alpine
        env: { POSTGRES_USER: fetcha, POSTGRES_PASSWORD: fetcha, POSTGRES_DB: fetcha }
        ports: ["5432:5432"]
        options: --health-cmd pg_isready --health-interval 5s --health-timeout 5s --health-retries 10
      redis:
        image: redis:7-alpine
        ports: ["6379:6379"]
    env:
      DATABASE_URL: postgres://fetcha:fetcha@localhost:5432/fetcha
      REDIS_URL: redis://localhost:6379
      AUTH_SECRET: ci-secret-0123456789abcdef0123456789abcdef
      INTERNAL_SERVICE_TOKEN: ci-internal
      NEXT_PUBLIC_SITE_URL: http://localhost:8220
      NEXT_TELEMETRY_DISABLED: "1"
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with: { version: 11 }
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - name: Lint
        run: pnpm --filter @fetcha/web lint
      - name: Typecheck
        run: pnpm typecheck
      - name: Migrate
        run: pnpm db:migrate && pnpm db:seed
      - name: Unit tests
        run: pnpm test
      - name: Security audit (high+)
        run: pnpm audit --audit-level high || true
      - name: Build
        run: pnpm build