name: Validate

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install Python test dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install --index-url https://download.pytorch.org/whl/cpu "torch>=2.5,<3"
          python -m pip install "aiohttp>=3.10,<4" "numpy>=1.26,<3" "Pillow>=10,<13" "jsonschema>=4.20,<5" "pathspec>=0.12,<1"
          # Test-only: the transport tests generate a throwaway TLS certificate.
          python -m pip install "cryptography>=42,<60"

      - name: Validate Python syntax
        run: python -m compileall -q __init__.py py

      - name: Run Python tests
        run: python -m unittest discover -s tests -v

      - name: Set up Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: ui/package-lock.json

      - name: Install UI dependencies
        working-directory: ui
        run: npm ci

      - name: Audit UI dependencies
        working-directory: ui
        run: npm audit --audit-level=high

      - name: Run frontend behavior tests
        working-directory: ui
        run: npm test

      - name: Type-check UI
        working-directory: ui
        run: npm run typecheck

      - name: Build UI
        working-directory: ui
        run: npm run build

      - name: Verify committed UI bundle and that the build emitted nothing else
        run: |
          git diff --exit-code -- js/
          test -z "$(git status --porcelain -- js/)"