name: Admin quality

on:
  workflow_call:
  pull_request:

concurrency:
  group: admin-quality-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: read

jobs:
  dependency-scan:
    name: Dependency vulnerability scan
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - uses: google/osv-scanner-action/osv-scanner-action@v2.3.8
        with:
          scan-args: --lockfile=pnpm-lock.yaml

  secret-scan:
    name: Secret scan
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  verify:
    name: Build, test, and quality checks
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: 10.28.2
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - run: pnpm install --frozen-lockfile
      - name: Generate API client from committed OpenAPI
        run: pnpm exec orval --config orval.config.ts
      - run: pnpm typecheck
      - run: pnpm lint
      - name: Production build and bundle budget
        run: pnpm exec next build && pnpm bundle:check
        env:
          NEXT_PUBLIC_API_URL: http://127.0.0.1:3000
      - name: Verify generated API client
        run: |
          set -euo pipefail
          pnpm exec orval --config orval.config.ts
          git diff --exit-code -- api/generated
      - run: pnpm test
      - run: pnpm architecture:check
      - run: pnpm unused:check