# Guards the WebSocket wire contract: the schema is well-formed, it has not
# broken compatibility, and the committed generated code matches it.
#
# The suites that decode the cross-language fixtures run in ci.yml, where the
# rest of the tests are. Nothing here downloads the upstream wordlist.
name: proto

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  contract:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # buf breaking compares against main, which needs real history.
          fetch-depth: 0

      - uses: bufbuild/buf-setup-action@v1
        with:
          version: 1.69.0

      - uses: actions/setup-go@v5
        with:
          go-version-file: server/go.mod
          cache-dependency-path: server/go.sum

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: web/package-lock.json

      - run: npm ci
        working-directory: web

      - name: Lint the schema
        run: buf lint

      # ref=origin/main, not branch=main: a pull_request checkout is a detached
      # HEAD with no local main, and branch=main fails there with a git clone
      # error rather than a breaking-change report.
      - name: Reject breaking changes
        run: buf breaking --against '.git#ref=origin/main'

      # A committed generated tree that no longer matches the schema is worse
      # than no generated tree at all: it compiles, and it is wrong.
      # --intent-to-add first: git diff ignores untracked files, so without it
      # a plugin that starts emitting a new file passes this check while the
      # committed tree is incomplete.
      - name: Verify the committed generated code is in sync
        run: |
          buf generate
          git add --intent-to-add -- server/gen web/src/lib/proto
          git diff --exit-code -- server/gen web/src/lib/proto