ci.yml

# CI for docBox — a public repo.
#
# There is deliberately NO docker-build job here. This repo's images build only on a real host:
# Docker-in-Docker with bind-mounted source resolves paths against the host filesystem, not the
# runner's, so an image built inside CI would bake in stale or empty source rather than the checked
# -out tree. Image builds happen on the host build path, never in Actions. See docker/ for how.
#
# Action versions are pinned to explicit release tags.
name: CI

on:
  push:
    branches: [main]
  pull_request:

# Least privilege: jobs only need to read the checked-out tree.
permissions:
  contents: read

# Cancel superseded runs on the same ref.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: Typecheck, build and test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.0

      - name: Set up pnpm
        uses: pnpm/action-setup@v6.0.9
        with:
          version: 10

      - name: Set up Node 24
        uses: actions/setup-node@v7.0.0
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      # One install for the whole workspace (app + server); scripts run per-package.
      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Typecheck (app + server)
        run: pnpm -r run typecheck

      # ADR-010: the frozen-contract boundary (ADR-009) as a mechanical gate —
      # a panel that reaches past the adapter seam or imports another feature fails here.
      - name: Boundary gate (dependency-cruiser)
        run: pnpm --filter @docbox/app run depcruise

      - name: Build (app)
        run: pnpm --filter @docbox/app run build

      - name: Test with coverage (app)
        run: pnpm --filter @docbox/app run test:coverage

      - name: Test with coverage (server)
        run: pnpm --filter @docbox/server run test:coverage

  docs-prose:
    name: Docs prose scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.0

      - name: Scan docs and README for banned marketing words
        run: |
          set -uo pipefail
          banned='seamless|leverage|robust|comprehensive|streamline'
          echo "Scanning docs/ and README.md for: ${banned//|/, }"
          if grep -rniE "\b(${banned})\b" docs README.md; then
            echo "::error::Banned marketing word found above. Rewrite in plain UK English (see CONTRIBUTING.md, rule 2)."
            exit 1
          fi
          echo "Prose scan clean: no banned words."

  secret-scan:
    name: Secret scan (gitleaks)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.0
        with:
          # Full history so gitleaks scans every commit, not just the tip.
          fetch-depth: 0

      # Run the gitleaks CLI directly. The gitleaks-action wrapper requires a
      # paid GITLEAKS_LICENSE for organization repos; the CLI (MIT) does not.
      - name: Install gitleaks
        run: |
          set -euo pipefail
          VERSION=8.30.1
          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \
            | tar -xz -C /usr/local/bin gitleaks
          gitleaks version

      - name: Scan for secrets
        run: gitleaks detect --source . --redact --verbose --no-banner