# Forgejo Actions — runs on Forgejo runners; GHA-compatible syntax.
name: Web Typecheck & Build

on:
  push:
    branches: [main]
    paths:
      - 'web/**'
      - '.forgejo/workflows/web.yml'
  pull_request:
    branches: [main]
    paths:
      - 'web/**'
      - '.forgejo/workflows/web.yml'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  typecheck-build:
    name: npm typecheck + build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: web
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20

      # The web app depends on private @lilith/* packages. The standard pattern
      # is to write the registry auth token to ~/.npmrc before install. If the
      # NPM_AUTH_TOKEN secret is not configured, install will fail — acceptable
      # for now.
      - name: Configure npm auth
        env:
          NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
        run: |
          echo "//registry.npmjs.org/:_authToken=${NPM_AUTH_TOKEN}" > ~/.npmrc
          echo "@lilith:registry=https://registry.npmjs.org/" >> ~/.npmrc

      - name: Install dependencies
        run: npm install --no-audit --no-fund

      - name: Typecheck
        run: npm run typecheck

      # If private packages are unavailable, surface a notice but don't fail
      # the whole pipeline on build alone.
      - name: Build
        continue-on-error: true
        run: npm run build
