ci.yml

name: CI

# Set default permissions as restrictive as possible
permissions: {}

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    # Only needs read-only access to contents
    permissions:
      contents: read
    strategy:
      matrix:
        node-version: [18.x, 20.x]

    steps:
      - uses: actions/checkout@v4

      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'yarn'

      - name: Install dependencies
        run: yarn install --immutable

      - name: Run linting
        run: yarn lint

      - name: Run tests
        run: yarn test

  build:
    name: Build
    runs-on: ubuntu-latest
    # Needs read-only access to contents and ability to upload artifacts
    permissions:
      contents: read
      actions: write  # Required for artifacts upload
    needs: test

    steps:
      - uses: actions/checkout@v4

      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20.x'
          cache: 'yarn'

      - name: Install dependencies
        run: yarn install --immutable

      - name: Build project
        run: yarn build

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-files
          path: build/
          retention-days: 7