name: CI

on:
  push:
    branches: [main]
  pull_request:

# Cancel an in-progress run when newer commits are pushed to the same ref.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Unit tests (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      # Supported desktop targets are Windows and Linux. macOS is not a
      # support target; do not imply it by testing on it.
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm

      # The capture unit tests require app/capture.js, which require()s the
      # electron module at load — so the Electron binary must actually be
      # installed (don't set ELECTRON_SKIP_BINARY_DOWNLOAD here).
      - name: Install dependencies
        run: npm ci

      - name: Run unit tests
        run: npm test

  audit:
    name: Dependency audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc

      # Production dependencies must be clean: these ship inside packages.
      - name: Audit production dependencies (blocking)
        run: npm audit --omit=dev --package-lock-only --audit-level=high

      # Full-tree audit including build/dev tooling is an explicit separate
      # signal: it must be visible but does not block unrelated changes.
      - name: Audit full dependency tree (informational)
        run: npm audit --package-lock-only --audit-level=high
        continue-on-error: true