name: CI

on:
  push:
    branches: [main]
  pull_request:

# Least privilege: CI only reads the checkout; it never writes to the repo,
# creates releases, or comments. Override per-job if a future job needs more.
permissions:
  contents: read

# Cancel superseded runs on the same ref (e.g. a force-push to a PR branch).
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm run typecheck
      - run: pnpm test
      - run: pnpm run build