ci.yml

name: CI

# The verification that used to live inside the Vercel deploy workflow. It
# belongs in its own file: prod is self-hosted on bitbaum, so the deploy
# workflow is now a shim over the shared pipeline — and that pipeline refuses
# to ship a commit whose CI is not green. Without this file there would be no
# CI to be green, and every deploy would sail through unverified.

on:
  workflow_dispatch: {}
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    name: Format, lint, test, build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: npm

      - run: npm ci

      # SSOT: format + lint + typecheck + test + build are bundled in the
      # `verify` npm script (package.json), and CI calls it verbatim so the
      # gating chain cannot drift from what a developer runs locally. This job
      # was already NAMED verify but re-inlined the chain, which is how the
      # typecheck gate went missing: `tsc --noEmit` ran nowhere, and type
      # errors were caught only as a side effect of `next build`.
      #
      # The `--if-present` flags are gone on purpose. They made three of these
      # gates unable to fail: rename or delete the `lint` script and the step
      # passes green instead of erroring. A gate that cannot go red is not a
      # gate — the same defect that let evig ship 25 failing tests under a ✓.
      - name: Verify (format + lint + typecheck + test + build)
        run: npm run verify