name: CI

on:
  push:
    branches: [main]
  pull_request:

# Least privilege: CI only reads the checked-out code; it never writes back to the repo.
permissions:
  contents: read

jobs:
  api:
    name: API - lint + tests
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/api
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Install
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev,all]"
      - name: Ruff
        run: ruff check forge migrations
      - name: Mypy (advisory — gradual typing, see CONTRIBUTING.md)
        continue-on-error: true
        run: mypy forge
      - name: Pytest
        run: pytest -q

  web:
    name: Web - typecheck + build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
        with:
          version: 9
      - uses: actions/setup-node@v7
        with:
          node-version: "22"
          cache: pnpm
      - name: Install
        run: pnpm install --frozen-lockfile || pnpm install
      - name: Build
        run: pnpm --filter web build