ci.yaml

name: CI
on:
  push:
    branches:
      - main
      - develop
  pull_request:
    branches:
      - main
      - develop

permissions:
  contents: read

jobs:
  check:
    name: check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
      - name: Setup Node.js
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
        with:
          node-version: ${{ vars.NODE_VERSION }}
      - name: Install dependencies
        run: npm ci --ignore-scripts
      - name: Run linter
        run: npm run lint
      - name: Run type checking
        run: npm run check
      - name: Verify CSP hashes
        run: |
          npm run generate:csp-script-hashes
          if [ -n "$(git status --porcelain)" ]; then
            echo "CSP hashes are not up to date. Please run 'npm run generate:csp-script-hashes' locally and commit the changes."
            git diff
            exit 1
          fi
  release:
    name: release
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'push' }}
    needs: [check]
    permissions:
      contents: write
      issues: write
      pull-requests: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
        with:
          fetch-depth: 0
      - name: Setup Node.js
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
        with:
          node-version: ${{ vars.NODE_VERSION }}
      - name: Install dependencies
        run: npm ci --ignore-scripts
      - name: Create release
        run: npx semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}