ci.yml

name: ci

on:
  pull_request:
  push:
    branches:
      - main
      - opensource

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Check out repository
        uses: actions/checkout@v5

      - name: Install Linux system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            build-essential \
            curl \
            file \
            libayatana-appindicator3-dev \
            libglib2.0-dev \
            librsvg2-dev \
            libssl-dev \
            libwebkit2gtk-4.1-dev \
            libxdo-dev \
            pkg-config

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install dependencies
        run: npm ci

      - name: Scan tracked files for public repo hygiene
        run: npm run scan:repo

      - name: Summarize dependency licenses
        run: npm run audit:licenses

      - name: Audit high-severity dependencies
        run: npm run audit:deps

      - name: Verify synced Tauri version
        run: |
          npm run sync-version
          git diff --exit-code package.json src-tauri/tauri.conf.json src-tauri/Cargo.toml

      - name: Build frontend
        run: npm run build:frontend

      - name: Build backend
        run: npm run build:backend

      - name: Smoke backend with lightweight mock gateway
        run: npm run smoke:backend

      - name: Check Tauri Rust crate
        run: cargo check --manifest-path src-tauri/Cargo.toml