name: check

on:
  push:
    branches: ['**']
    tags: ['v*']
  workflow_dispatch:

jobs:
  frontend:
    runs-on: nix:host
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@v4

      - name: Install npm dependencies
        run: nix develop --command bash -c "cd web && npm ci"

      - name: svelte-check
        run: nix develop --command bash -c "cd web && npm run check"

      - name: Production build
        run: nix develop --command bash -c "cd web && npm run build"

      - name: Confirm SW + manifest emitted
        run: |
          test -f web/build/index.html
          test -f web/build/service-worker.js
          test -f web/build/manifest.webmanifest
          test -f web/build/robots.txt

  server:
    runs-on: nix:host
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@v4

      - name: go vet
        run: nix develop --command bash -c "cd server && go vet ./..."

      - name: go build
        run: nix develop --command bash -c "cd server && go build ./..."

      - name: Confirm strict mode refuses to start without secrets
        run: |
          set +e
          nix develop --command bash -c "cd server && DOCENT_PASSWORD=t go run . -strict -addr :0" 2>&1 | tee /tmp/strict.log
          status=${PIPESTATUS[0]}
          if [ "$status" -eq 0 ]; then
            echo "expected -strict to refuse to start without DOCENT_COOKIE_SECRET" >&2
            exit 1
          fi
          grep -q "DOCENT_QR_KEY must be set in -strict mode\|DOCENT_COOKIE_SECRET must be set in -strict mode" /tmp/strict.log