# CI for the rom-manager workspace (Gitea Actions). Mirrors the main repo's TS workflows:
# ubuntu-24.04 runner + the oven/bun:1 container, auth via the shared REGISTRY_TOKEN secret.
# One root install covers all workspaces (contract + plugin + ui); @punktfunk/* and
# @unom/* resolve from the Gitea registry via the root bunfig scope maps, effect and
# @effect/atom-react from npm. Publish runs on a `v*` tag, from plugin/.
name: CI

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-24.04
    container:
      image: oven/bun:1
    timeout-minutes: 15
    steps:
      # oven/bun's slim base ships neither git nor a CA bundle — actions/checkout's HTTPS fetch needs both.
      - name: Install git + CA certs
        run: apt-get update && apt-get install -y --no-install-recommends ca-certificates git nodejs
      - uses: actions/checkout@v4
      - name: Registry auth
        env:
          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          test -n "$TOKEN" || { echo "REGISTRY_TOKEN secret is empty"; exit 1; }
          printf '//git.unom.io/api/packages/unom/npm/:_authToken=%s\n' "$TOKEN" > "$HOME/.npmrc"
      - name: Install (workspace)
        run: bun install --frozen-lockfile
      - name: Lint & format
        run: bunx biome check
      - name: Typecheck (contract)
        working-directory: contract
        run: bunx tsc --noEmit
      - name: Typecheck (plugin)
        working-directory: plugin
        run: bunx tsc --noEmit
      - name: Test (domain + services)
        working-directory: plugin
        run: bun test
      - name: Build backend bundle + SPA
        working-directory: plugin
        run: bun run build:all
      - name: Typecheck (UI)
        working-directory: ui
        run: bunx tsc --noEmit
      - name: Sanity — plugin default export is a valid PluginDef
        working-directory: plugin
        run: |
          bun -e 'import plugin from "./dist/index.js"; if (plugin?.name !== "rom-manager" || typeof plugin?.main !== "function") { console.error("bad default export", plugin); process.exit(1); } console.log("ok:", plugin.name)'

  publish:
    needs: build
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-24.04
    container:
      image: oven/bun:1
    timeout-minutes: 15
    steps:
      - name: Install git + CA certs
        run: apt-get update && apt-get install -y --no-install-recommends ca-certificates git nodejs
      - uses: actions/checkout@v4
      - name: Registry auth
        env:
          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          test -n "$TOKEN" || { echo "REGISTRY_TOKEN secret is empty"; exit 1; }
          printf '//git.unom.io/api/packages/unom/npm/:_authToken=%s\n' "$TOKEN" > "$HOME/.npmrc"
      - name: Install (workspace)
        run: bun install --frozen-lockfile
      - name: Tag matches package version
        working-directory: plugin
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          PKG="$(node -p "require('./package.json').version")"
          test "$TAG" = "$PKG" || { echo "tag $GITHUB_REF_NAME != package version $PKG"; exit 1; }
      - name: Publish (prepublishOnly builds backend + SPA)
        working-directory: plugin
        run: bun publish