name: CI
on:
  push:
    branches: [main]
  pull_request:
  # Lets CI be run by hand against any ref, including a specific commit.
  # Without this there is no way to re-run a check that never started: a run
  # GitHub queues and then orphans -- as it did to every run created during the
  # Actions outage on 2026-08-26 -- can be neither rerun ("already running")
  # nor canceled ("already completed"), and the workflow has no other trigger
  # to reach for. Useful too for putting a check on a commit that predates a CI
  # change, without pushing an empty commit to move it.
  workflow_dispatch:
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      # Every `uses:` in this repository is pinned to a full commit SHA, with
      # the release it belongs to in the trailing comment, and the repository
      # requires it -- an unpinned ref fails the run rather than quietly
      # resolving. A tag is a mutable pointer: `@v7` is whatever the publisher
      # last moved it to, so trusting one is trusting every future version of
      # that action, including the one pushed by whoever compromises the
      # account. Read the comment for the version; the SHA is what runs.
      #
      # Dependabot updates both halves together on its weekly github-actions
      # run, so this costs nothing to keep current -- do not "simplify" a pin
      # back to a tag.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 26
          cache: npm
      - run: npm ci --ignore-scripts
      - run: npm run typecheck
      - run: npm test
      - run: npm run build
      - name: Docker build
        run: docker build -t ihasmail:ci .