ci.yml

# CI runs the corpus's own proof: npm run check.
#
# The previous workflow could not have passed. No job ran `npm ci`, so every
# `npx eslint` / `npx jest` executed with no local node_modules and
# eslint.config.mjs could not resolve its imports. It also pinned Node 18/20,
# while the kernel runs under --experimental-strip-types (Node 22+).
#
# `npm run check` is the real gate — kernel smoke tests, the ambient-Math ban,
# bundle/skills/readme/docs/spectrum seals, MCP smoke, and the self-develop
# tip. It fails closed, so it is what CI should assert.
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  check:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        # 22 is the floor for --experimental-strip-types.
        node-version: [22.x, 24.x]
    steps:
      # Full history and tags. Five things in `npm run check` read git:
      # version-seal compares against existing tags, changelog-facts reads the
      # log, semver-diff needs the published surface, and rights-check verifies
      # the copyright holder is the sole author of the history. A shallow clone
      # leaves every one of them passing on one commit and no tags — green for
      # the wrong reason, which is worse than red.
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm

      - name: Install
        run: npm ci

      # `npm run check` now builds the docs site too, so there is no separate
      # docs step: it was the one CI step outside the gate, and a dead link
      # rode that gap through six pushes with check green the whole way.
      - name: Gate — npm run check
        run: npm run check

      # Detail only; the ratchet in `npm run check` is what fails on a
      # regression. Runs on one leg to avoid duplicate output.
      - name: Report TypeScript errors (non-blocking)
        if: matrix.node-version == '22.x'
        run: npx tsc --noEmit -p tsconfig.typecheck.json || true

      - name: Report lint (non-blocking)
        if: matrix.node-version == '22.x'
        run: npx eslint src/ || true

  # typecheck and lint were separate jobs, each paying its own checkout and
  # npm ci to print detail the ratchet already GATES. Folded into the matrix
  # job above as steps that reuse the install: three installs became one per
  # leg. Both stay non-blocking — the counts fail in `npm run check`, these
  # just show which errors they are.