name: PR Check — Frontend

# Frontend half of the former check.yml (split in #232).
#
# Filtered with paths-ignore rather than an allowlist: this job costs ~2.5 min,
# so running it when it was not strictly needed is cheap, while silently NOT
# running it is not. A root-level config file added later would drop out of an
# allowlist without anyone noticing; here it fails safe.
#
# No `branches:` filter — see check-rust.yml.

on:
  pull_request:
    paths-ignore:
      - 'src-tauri/**'
      - '.cargo/**'
      - 'docs/**'
      - 'reports/**'
      - 'tasks/**'
      - '.github/**'
      - '.claude/**'
      - '.forgejo/workflows/check-rust.yml'
      - '.forgejo/workflows/audit.yml'
      - '.forgejo/workflows/release.yml'
      - '*.md'
      - 'LICENSE'

# Same concurrency setup as check-rust.yml (own group, cancel-in-progress),
# whose comment says what it does on Forgejo 8.0.3 (#376) and why each
# workflow has its own group.
concurrency:
  group: ci-frontend-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  frontend:
    runs-on: ubuntu
    container: ubuntu:22.04
    steps:
      - name: Install Node.js 24
        run: |
          apt-get update
          apt-get install -y --no-install-recommends curl ca-certificates git
          curl -fsSL https://deb.nodesource.com/setup_24.x | bash -
          apt-get install -y nodejs
          node --version
          npm --version

      - name: Checkout
        uses: https://github.com/actions/checkout@v4

      # No npm cache step, by decision (#234). The runner's cache works since
      # 2026-10-03, but it keeps what a pull_request run saves private to that
      # PR, and this workflow runs on PRs only: a cache would serve later
      # pushes to the same PR, while `npm ci` takes 9s here (run 456) and
      # each PR's first run would pay for the save.

      - name: Install dependencies
        run: npm ci

      - name: Build (tsc + vite)
        run: npm run build

      - name: Tests (vitest)
        run: npm test