name: CI (SIAX Cloud)
on: [push, pull_request, workflow_dispatch]
jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - uses: pnpm/action-setup@v4
        with:
          version: 9.15.9
      - name: Install
        run: pnpm install --frozen-lockfile
      - name: Canonical architecture policy
        run: pnpm run validate:architecture
      - name: Typecheck
        run: pnpm run typecheck
      - name: Test
        run: pnpm run test
      - name: Build
        run: pnpm run build
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Trivy
        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
      - name: Scan
        run: trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 0 .
  contracts:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - uses: pnpm/action-setup@v4
        with:
          version: 9.15.9
      - name: Install
        run: pnpm install --frozen-lockfile
      - name: Canonical architecture policy
        run: pnpm run validate:architecture
      - name: Check schema/contracts and provenance policy
        run: pnpm --filter @siax/c0py-core test