name: CI

on:
  pull_request:
  # Lets a bot-pushed commit be verified on demand: GITHUB_TOKEN pushes do not
  # trigger workflows, so the nightly refresh otherwise leaves main's CI status
  # reflecting the last human push.
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - '**.go'
      - 'go.mod'
      - 'go.sum'
      - '.github/workflows/ci.yml'
      - 'data/agents.yml'
      - 'templates/**'
      - 'site/**'

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-go@v7
        with:
          go-version: 'stable'
          cache: true

      - run: go vet ./...
      - run: go test ./...
      - run: go build ./...
      - run: go run . -check
      # Runs exactly what Cloudflare Pages runs, so a build that would fail on
      # deploy fails here instead. Needs no token — that is the point of the split.
      - run: go run . -build

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-go@v7
        with:
          go-version: 'stable'
          cache: true

      - uses: golangci/golangci-lint-action@v9

  vulncheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-go@v7
        with:
          go-version: 'stable'
          cache: true

      - uses: golang/govulncheck-action@v1