name: CI

on:
  push:
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    name: Test and lint
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22
          cache: npm

      - name: Install Node.js dependencies
        run: npm ci

      - name: Run tests
        run: npm test

      - name: Check JavaScript syntax
        run: npm run check

      - name: Check shell scripts
        run: shellcheck -x scripts/*.sh scripts/lib/*.sh runtime/start.sh.template

      - name: Check Bash syntax
        run: bash -n scripts/*.sh scripts/lib/*.sh runtime/start.sh.template

      - name: Install Nix
        uses: cachix/install-nix-action@b4b293eae0b79aac8a161bb32925a5508c9cca93 # v31

      - name: Check Nix flake
        run: nix flake check