ci.yml

# Golden CI floor — see dotfiles/templates/ci/README.md.
# datacat: npm monorepo (frontend/ + backend/). The only tests are full-stack
# Playwright e2e that need both servers + a DB running — NOT hermetic, so they
# are deferred to a future e2e job (lift revampit's e2e-local pattern once a
# seeded DB service is wired). This floor gates the frontend quality signals
# that currently never run: lint, typecheck, build (contentlayer + prisma
# generate + next build). The frontend needs --legacy-peer-deps (proven in the
# old deploy workflow). The production Docker deploy stays disabled — enabling a
# deploy is an outward-facing decision, not part of the CI floor.
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify-frontend:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          # Node 18: contentlayer (unmaintained) crashes on exit under Node 20+
          # (ERR_INVALID_ARG_TYPE in clipanion) even though it generates docs
          # fine. The old deploy workflow pinned 18 for the same reason.
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install
        working-directory: frontend
        run: npm ci --legacy-peer-deps

      # SSOT: one definition of "verified" lives in the ROOT package.json
      # `verify` (lint + typecheck + build), run identically here and locally.
      # Runs from repo root — the scripts cd into frontend themselves.
      #
      # Build is IN the gate as of 2026-08-04. It was deferred on a prisma-engine
      # issue, and the cost of that gap was exact: contentlayer 0.3.1 reaches into
      # a React internal that React 19 removed, so `/blog/[slug]` threw
      # "d.getOwner is not a function" during prerender. lint and typecheck were
      # both green — only a build could have caught it. The breakage sat on main
      # while every CI run reported success.
      - name: Verify
        run: npm run verify

      # The full-stack Playwright e2e is still DEFERRED, not skipped silently:
      # it needs both servers plus a seeded DB (lift revampit's e2e-local pattern
      # from dotfiles/templates/ci/README.md once that is wired).