name: build-verify

# Catches the exact class of failure that broke two consecutive PeerCortex
# deploys on 2026-07-16: server.js requiring a local file that was never
# actually committed/uploaded (MODULE_NOT_FOUND crash-loop on Erik), and a
# runtime dependency (pg) missing from package.json/node_modules. Runs on
# every push and PR; does NOT deploy anything -- see deploy.sh / the manual
# Erik deploy process for that.
#
# No untrusted event data (PR titles/bodies/commit messages) is interpolated
# into any run: step below -- nothing here is exposed to injection.

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  build-verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: npm ci
        run: npm ci

      - name: server.js / local-db-client.js / bio-rd-client.js syntax
        run: |
          for f in server.js local-db-client.js bio-rd-client.js bgp-hijack-monitor.js magatama-s2ten-bgp-enrichment.js; do
            [ -f "$f" ] && node --check "$f"
          done

      - name: every local require() target actually exists
        run: |
          MISSING=0
          for f in server.js local-db-client.js bio-rd-client.js; do
            [ -f "$f" ] || continue
            for req in $(grep -oE "require\(['\"]\./[^'\"]+['\"]\)" "$f" | sed -E "s/require\(['\"]\.\/([^'\"]+)['\"]\)/\1/"); do
              target="$req"
              if [ ! -f "$target" ] && [ ! -f "$target.js" ] && [ ! -d "$target" ]; then
                echo "::error file=$f::require('./$req') has no matching file (checked $target, $target.js)"
                MISSING=1
              fi
            done
          done
          exit $MISSING

      - name: TypeScript typecheck
        run: npx tsc --noEmit --pretty false || true
        # Non-blocking for now: src/mcp-server/* and src/sources/* have pre-existing
        # errors unrelated to the deployed server.js path (see project memory,
        # 2026-07-16 audit). Flip to a hard failure once those are cleaned up --
        # until then this step is informational only, visible in the job log.

      - name: build (dist/)
        run: |
          # tsc exits non-zero because of pre-existing src/mcp-server/* type errors
          # (unrelated to the server.js/API-server path this build actually needs --
          # see the typecheck step above), but with noEmitOnError left at its default
          # (false) it still emits working output for files that DID typecheck
          # cleanly. Confirmed on Erik 2026-07-16: `npm run build` returns exit 2 but
          # dist/api/index.js and dist/api/server.js are both present and correct.
          # So: don't fail the job on tsc's exit code, fail it only if the specific
          # files the deploy actually needs are missing.
          npm run build || true
          MISSING=0
          for f in dist/api/index.js dist/api/server.js dist/aspa/validator.js; do
            if [ ! -f "$f" ]; then
              echo "::error::required build output missing: $f"
              MISSING=1
            fi
          done
          exit $MISSING

      - name: vitest
        run: npm test
        # KNOWN OPEN ISSUE (2026-07-16): this step fails in 0-1s on this specific
        # Gitea Actions runner for a reason not diagnosable from a local machine --
        # tried forcing a small fixed forks pool (--pool=forks, min/maxForks) as a
        # guess (common fix for CI-only vitest worker-pool crashes), made no
        # difference. The actual test suite passes 215/215 reliably every way
        # tested locally: plain `npm test`, with CI=true set, and after a fully
        # fresh `rm -rf node_modules && npm ci`. The job's "Complete job" step
        # also shows failure/canRerun:false, which may indicate a runner-level
        # issue rather than a test-code issue. Needs someone with actual
        # logged-in dashboard access to this Gitea instance to read the real
        # step log -- not accessible via this session's tooling (Gitea Actions
        # log API returned 404 for every endpoint pattern tried; the web log
        # viewer requires an authenticated session to stream content).
        # Every OTHER step in this workflow (syntax, require() check, typecheck,
        # build) is confirmed working and already caught 2 real bugs today.