ci.yml

name: CI

description: Lints, tests, and builds on pull requests and pushes to master.

on:
  pull_request:
  push:
    branches:
      - master

# Concurrency is PER-REF so that different PRs' CI runs never cancel each
# other. `cancel-in-progress: true` ensures only the latest push to a given
# ref runs — redundant pushes (e.g. two quick pushes to the same PR) cancel
# the previous run instead of queuing behind it, saving CI time.
#
# Docker-build serialization is handled by the self-hosted runner: if only
# one runner exists in the "team-extensions" group, GitHub assigns jobs
# one at a time, so Docker builds never overlap and the shared BuildKit
# instance is never stressed by concurrent builds.
concurrency:
  group: ci-ext-scriptlets-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  ci:
    name: CI
    runs-on: team-extensions
    permissions:
      # Least privilege: CI only checks out and builds; it never pushes from
      # this workflow, so the default token permissions are reduced.
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Set dev version
        uses: >-
          AdGuardSoftwareLimited/ext-shared-actions/.github/actions/set-dev-version@master

      - name: Lint
        run: DOCKER_BUILDKIT=1 docker build --progress plain --target lint-output .

      - name: Vitest
        run: DOCKER_BUILDKIT=1 docker build --progress plain --target test-vitest-output .

      - name: QUnit
        run: DOCKER_BUILDKIT=1 docker build --progress plain --target test-qunit-output .

      - name: Smoke tests
        run: DOCKER_BUILDKIT=1 docker build --progress plain --target test-smoke-output .

      - name: Build release artifacts
        run: >-
          DOCKER_BUILDKIT=1 docker build --progress plain
          --target build-output --output ./artifacts .

      - name: Upload npm package
        uses: actions/upload-artifact@v7
        with:
          name: npm-package
          path: artifacts/scriptlets.tgz