name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  client-installer:
    name: Client installer (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22.13
          cache: npm
      - run: npm ci
      - run: npm run build
      - run: node --test dist/test/client-installer.test.js

  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [22, 24]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm
      - run: npm ci
      - run: npm test
      - run: npm audit --omit=dev --audit-level=high

  release-smoke:
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: rm distribution/release-signing-public.pem
      - run: npm run release:keygen
      - run: >-
          npm run release:build --
          --gateway-url https://approval.example.com/mcp
          --download-base-url https://approval.example.com/downloads/dingmcp
          --out release-ci
      - run: >-
          npm run test-bundle:build --
          --release-dir release-ci
          --bundle release-ci/dingmcp-test-bundle.tar.gz
          --bundle-url https://approval.example.com/downloads/dingmcp/dingmcp-test-bundle.tar.gz
          --prompt release-ci/agent-test-install.md
      - run: cd release-ci && sha256sum -c SHA256SUMS
      - run: npm run release:verify -- --release-dir release-ci