name: build-verify

# Catches the exact class of failure that broke two consecutive PeerCortex
# deploys on 2026-07-16: server.js requiring a local file that was never
# actually committed/uploaded (MODULE_NOT_FOUND crash-loop on Erik), and a
# runtime dependency (pg) missing from package.json/node_modules. Runs on
# every push and PR; does NOT deploy anything -- see deploy.sh / the manual
# Erik deploy process for that.
#
# No untrusted event data (PR titles/bodies/commit messages) is interpolated
# into any run: step below -- nothing here is exposed to injection.

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  build-verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: npm ci
        run: npm ci

      - name: server.js / local-db-client.js / bio-rd-client.js syntax
        run: |
          for f in server.js local-db-client.js bio-rd-client.js bgp-hijack-monitor.js magatama-s2ten-bgp-enrichment.js; do
            [ -f "$f" ] && node --check "$f"
          done

      - name: every local require() target actually exists
        run: |
          MISSING=0
          for f in server.js local-db-client.js bio-rd-client.js; do
            [ -f "$f" ] || continue
            for req in $(grep -oE "require\(['\"]\./[^'\"]+['\"]\)" "$f" | sed -E "s/require\(['\"]\.\/([^'\"]+)['\"]\)/\1/"); do
              target="$req"
              if [ ! -f "$target" ] && [ ! -f "$target.js" ] && [ ! -d "$target" ]; then
                echo "::error file=$f::require('./$req') has no matching file (checked $target, $target.js)"
                MISSING=1
              fi
            done
          done
          exit $MISSING

      - name: TypeScript typecheck
        run: npx tsc --noEmit --pretty false || true
        # Non-blocking for now: src/mcp-server/* and src/sources/* have pre-existing
        # errors unrelated to the deployed server.js path (see project memory,
        # 2026-07-16 audit). Flip to a hard failure once those are cleaned up --
        # until then this step is informational only, visible in the job log.

      - name: build (dist/)
        run: |
          # tsc exits non-zero because of pre-existing src/mcp-server/* type errors
          # (unrelated to the server.js/API-server path this build actually needs --
          # see the typecheck step above), but with noEmitOnError left at its default
          # (false) it still emits working output for files that DID typecheck
          # cleanly. Confirmed on Erik 2026-07-16: `npm run build` returns exit 2 but
          # dist/api/index.js and dist/api/server.js are both present and correct.
          # So: don't fail the job on tsc's exit code, fail it only if the specific
          # files the deploy actually needs are missing.
          npm run build || true
          MISSING=0
          for f in dist/api/index.js dist/api/server.js dist/aspa/validator.js; do
            if [ ! -f "$f" ]; then
              echo "::error::required build output missing: $f"
              MISSING=1
            fi
          done
          exit $MISSING

      - name: vitest
        run: npm test
        # Fixed 2026-07-17: the 0-1s pre-test-load crash on this runner was
        # package-lock.json missing per-platform optional-dependency entries
        # for Rollup/esbuild's native Linux binaries (npm/cli#4828) -- the
        # lockfile had only been regenerated on darwin-arm64, so `npm ci` on
        # the Linux runner silently skipped @rollup/rollup-linux-x64-gnu and
        # @esbuild/linux-x64, and Vite's synchronous require() of them at
        # startup threw before any test file ran. Resolved as a side effect
        # of regenerating package-lock.json in commit a0ad052.