ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]

# A new push to the same branch makes the in-flight run obsolete.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  verify:
    name: lint · test · build
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v7

      # Node 24 LTS matches the Vercel production runtime. The repo pins no
      # engines field, so this workflow is the de facto version of record —
      # change both together if prod moves.
      #
      # v7 of both actions runs natively on Node 24. v4 targeted Node 20 and
      # was being force-run on 24 with a deprecation annotation on every run.
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm

      - name: Install
        run: npm ci

      # The --max-warnings=0 flag lives in the `lint` script, not here, so a
      # local run fails the same way CI does. Warnings are now errors.
      - name: Lint
        run: npm run lint

      - name: Test
        run: npm test

      # No secrets needed: src/env.ts validates ANTHROPIC_API_KEY lazily on
      # first getClient() call, not at import or build time, so a keyless
      # build is a real check rather than one that passes by accident.
      - name: Build
        run: npm run build