build.yml

name: Build

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

permissions:
  contents: read

jobs:
  build-and-test:
    runs-on: ${{ matrix.os }}
    
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        node-version: [18.x, 20.x]
    
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
      with:
        egress-policy: audit

    - name: Checkout code
      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      
    - name: Setup Node.js ${{ matrix.node-version }}
      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
      with:
        node-version: ${{ matrix.node-version }}
        cache: 'npm'
        
    - name: Install dependencies
      run: npm ci
      
    - name: Run linting
      run: npm run lint
      
    - name: Run type checking
      run: npm run check-types
      
    - name: Compile extension
      run: npm run compile
      
    - name: Build production package
      run: npm run package
      
    - name: Compile tests
      run: npm run compile-tests
      
    - name: Verify build outputs exist
      shell: bash
      run: |
        if [ ! -f "dist/extension.js" ]; then
          echo "❌ dist/extension.js not found"
          exit 1
        fi
        if [ ! -d "out" ]; then
          echo "❌ out directory not found"
          exit 1
        fi
        echo "✅ Build outputs verified"
        
    - name: Upload build artifacts
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      if: matrix.os == 'ubuntu-latest' && matrix.node-version == '20.x'
      with:
        name: build-artifacts
        path: |
          dist/extension.js
          dist/extension.js.map
          out/
        retention-days: 7