← ubon

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build-test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        node-version: [20, 22, 24]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
      - run: npm ci
      - run: npm run lint
      - run: npm run build
      - run: npm run rules:gen
      - run: npm run rules:sync
      - run: npm test

      - name: Smoke run (JSON + SARIF)
        run: node dist/cli.js check --json --sarif ubon.sarif --fail-on none

      - name: Smoke run (NDJSON)
        run: node dist/cli.js check --ndjson --no-result-cache --fail-on none > ubon.ndjson

      - name: Smoke run (schema dump)
        run: node dist/cli.js check --schema > ubon-schema.json

      - name: Dogfood — run Ubon on Ubon
        # Eat our own dog food: Ubon must not flag itself as critical.
        # `--focus-critical --fail-on error` keeps the gate tight without
        # turning every minor finding into a CI failure.
        run: node dist/cli.js check --focus-critical --fail-on error

      - name: Upload SARIF
        if: matrix.node-version == 22
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ubon.sarif

      - name: Upload coverage (Node 22 only)
        if: matrix.node-version == 22
        uses: actions/upload-artifact@v4
        with:
          name: coverage
          path: coverage/
          retention-days: 7