ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  build-test-audit:
    name: Build, test, audit (Node ${{ matrix.node }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        node: ["20", "22"]
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node }}
          cache: npm

      - name: Install (clean)
        run: npm ci

      - name: Type-check and build
        run: npm run build

      - name: Run tests
        run: npm test

      - name: Theme-matching eval
        run: npm run eval -- --min-f1 0.90

      - name: npm audit (high+)
        run: npm run audit:ci