name: CI

# Reusable CI checks (typecheck + npm audit). Invoked by ship-ci.yml's `CI`
# job for PRs into main and release/** so the check run is named "CI / check",
# matching the org rulesets' required context. It deliberately has no
# standalone pull_request trigger: a direct run would publish a bare "check"
# that the rulesets can't match.
on:
  workflow_call:
  workflow_dispatch:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-22.04

    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Read build configuration
        id: config
        shell: bash
        run: |
          NODE_VERSION=$(node -p "require('./.build-config.json').versions.node")
          echo "node=$NODE_VERSION" >> "$GITHUB_OUTPUT"

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ steps.config.outputs.node }}

      # No package-lock.json in this repo — npm ci is not available.
      - name: Install npm dependencies
        run: npm install

      - name: TypeScript type check
        run: npm run typecheck

      - name: npm audit
        run: npm audit --audit-level=high
        continue-on-error: true