name: Frontend checks

on:
  pull_request:
    branches: [main, dev, staging]
  push:
    branches: [main, dev, staging]
  workflow_dispatch: {}

permissions:
  contents: read

jobs:
  build-and-test:
    name: Build and test
    # Org reusable workflow (Node 24): format check, lint, build, unit tests.
    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-frontend.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
    with:
      node-version: "24"

  governance:
    # Repo-owned guarantee that every frontend quality gate runs from this
    # repository, independent of (and in addition to) the reusable workflow.
    # `npm run verify` is the single command that chains: format check, lint
    # (--max-warnings=0), type-check + build, unit tests, then the governance
    # checks in scripts/governance-check.mjs (godfile ratchet + changed-file
    # maintainability gate). If the reusable workflow is later confirmed to run
    # every gate, this job can be slimmed to `npm run governance`.
    #
    # GOVERNANCE_BASE points the changed-file gate at the right diff:
    #   PR  -> the PR target branch (origin/<base_ref>)
    #   push-> the previous commit on the branch (github.event.before)
    #   manual -> dev, for exact-head recovery runs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Resolve governance comparison ref
        id: governance-ref
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          EVENT_BEFORE: ${{ github.event.before }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          set -euo pipefail
          if [[ "${EVENT_NAME}" == "pull_request" ]]; then
            base="${PR_BASE_SHA}"
          elif [[ "${EVENT_NAME}" == "push" && -n "${EVENT_BEFORE}" && ! "${EVENT_BEFORE}" =~ ^0+$ ]]; then
            base="${EVENT_BEFORE}"
          else
            base="origin/dev"
          fi
          printf 'base=%s\n' "${base}" >> "${GITHUB_OUTPUT}"
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"
          cache: npm
      - run: npm ci
      - run: npm run verify
        env:
          GOVERNANCE_BASE: ${{ steps.governance-ref.outputs.base }}

  visual-regression:
    name: Visual regression
    runs-on: ubuntu-latest
    container: mcr.microsoft.com/playwright:v1.61.1-noble
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"
          cache: npm
      - run: npm ci
      - run: npm run test:e2e:visual
      - name: Upload visual diff artifacts
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: visual-regression-diffs
          path: |
            test-results/visual
            playwright-report-visual
          if-no-files-found: ignore
          retention-days: 14