ci.yml

name: CI

# Gate every PR and every push to main on the same three checks the
# publish workflow runs before shipping: lint, type-compile, and vsix
# pack. If a contributor's PR can't be packaged, the marketplace
# upload would have failed anyway, so failing fast here saves a
# release-day fire-drill.

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - run: npm ci

      - name: Lint
        run: npm run lint

      - name: TypeScript compile
        run: npm run compile

      - name: Unit tests
        run: npm test

      - name: Bundle smoke
        # Catches the "vsix packages but won't load" failure mode — a
        # successful vsce package doesn't prove the bundle has all its
        # runtime deps. Loads dist/extension.js with a vscode stub and
        # asserts activate/deactivate are exported.
        run: npm run smoke

      - name: npm audit (prod deps, high+)
        run: npm audit --omit=dev --audit-level=high

      - name: Verify vsix packs cleanly
        # vsce is a pinned devDependency (see package.json) — Dependabot
        # bumps it via the npm config. `npm ci` has already installed it.
        run: |
          npx vsce package --out pipeline-check.vsix
          ls -lh pipeline-check.vsix

      - uses: actions/upload-artifact@v4
        with:
          name: vsix
          path: pipeline-check.vsix
          retention-days: 14