name: CI
on:
  push:
    branches: [main]
  pull_request:
  # Lets a run be started by hand against any ref, including one GitHub
  # queued and then orphaned.
  workflow_dispatch:
permissions:
  contents: read
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 26
          cache: npm
          cache-dependency-path: web/package-lock.json
      - run: npm ci --ignore-scripts --no-audit --no-fund
        working-directory: web
      - run: npm run build
        working-directory: web
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - run: go vet ./...
      - run: go test -count=1 ./...
      - name: govulncheck
        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
      - name: Docker build
        run: docker build -t wgx:ci .