# Reference workflow (the canonical remote is spbgit, which has no runner; scripts/ci.sh runs the same gates locally and on the node).
name: ci
on: [push, pull_request]
jobs:
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: pgvector/pgvector:pg17
        env: { POSTGRES_PASSWORD: ci, POSTGRES_DB: tools_spboucher_test }
        ports: ["5432:5432"]
        options: --health-cmd pg_isready --health-interval 5s --health-timeout 5s --health-retries 10
    env:
      DATABASE_URL: postgres://postgres:ci@localhost:5432/tools_spboucher_test
      DATABASE_URL_ADMIN: postgres://postgres:ci@localhost:5432/tools_spboucher_test
      TEST_DATABASE_URL: postgres://postgres:ci@localhost:5432/tools_spboucher_test
      SESSION_SECRET: ci-secret
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with: { node-version: 26, cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - run: pnpm typecheck
      - run: pnpm content:validate
      - run: pnpm db:migrate
      - run: pnpm test
      - run: pnpm content:import --publish && pnpm eval:ranking
      - run: pnpm audit --prod --audit-level high || true