ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:

permissions:
  contents: read

jobs:
  build-and-test:
    name: Typecheck, test, and package
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      # Phase 40.20 — Catch transitive CVEs at PR time, mirroring the
      # monaco-editor 2026-05-12..15 dependency-audit wave.
      # `--audit-level=high` filters out noise (low/moderate informational)
      # but fails the build on actually exploitable advisories.
      # `--omit=optional` keeps the noise floor down; optional deps don't
      # ship in the extension bundle.
      - name: npm audit (high+ severity)
        run: npm audit --audit-level=high --omit=optional
        continue-on-error: true

      - name: Typecheck
        run: npm run typecheck

      - name: Test
        run: npm test

      - name: Build extension bundle
        run: npm run build

      - name: Set up Chrome
        id: setup-chrome
        uses: browser-actions/setup-chrome@v1

      - name: Smoke test dashboard
        run: npm run smoke:dashboard
        env:
          SCRIPT_VAULT_CHROME_PATH: ${{ steps.setup-chrome.outputs.chrome-path }}

      - name: Package Chrome extension
        run: bash build.sh

      - name: Upload Chrome package
        uses: actions/upload-artifact@v4
        with:
          name: scriptvault-chrome-package
          path: ScriptVault-v*.zip
          if-no-files-found: error