name: ci
on: [push, pull_request]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with: { version: 9 }
      - uses: actions/setup-node@v4
        with: { node-version: 20, cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - run: pnpm typecheck
      - run: pnpm lint
      - run: pnpm test

  bind-env-drift:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # SSOT 게이트: ds-sdk bind-env.json ↔ private-cluster infra/api/yakcloud_api.py _bind_env_for()
      # 리포 경계: 대상 Python 을 sparse-checkout(읽기전용 토큰)해 .infra-ref/ 로 가져온다.
      - name: fetch infra ref (sparse)
        run: |
          echo "TODO: sparse-checkout private-cluster infra/api/yakcloud_api.py -> .infra-ref/"
      - uses: pnpm/action-setup@v4
        with: { version: 9 }
      - uses: actions/setup-node@v4
        with: { node-version: 20 }
      - run: node scripts/bind-env-check.mjs --python .infra-ref/infra/api/yakcloud_api.py

  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - name: gitleaks
        run: echo "TODO: gitleaks detect --no-git=false"

  standalone-smoke:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with: { version: 9 }
      - uses: actions/setup-node@v4
        with: { node-version: 20 }
      - run: pnpm install --frozen-lockfile
      # #9 불변식: 무DB·무Keycloak 환경에서 클라 패키지 import 시 서버전용 모듈(Prisma/next-auth) 정적 유출 0
      - run: node scripts/standalone-smoke.mjs