test.yml

on:
  pull_request:
    types: [opened, synchronize, reopened]
    branches:
      - '**'
  push:
    branches:
      - 'main'

permissions:
  id-token: write
  contents: read
  attestations: read

name: CI Test, Typecheck, Benchmark
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-test
  cancel-in-progress: true
env:
  CI: true
  NODE_OPTIONS: --max-old-space-size=8192
  HUSKY: 0

jobs:
  test:
    name: Test & Typecheck
    runs-on: macos-latest

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install pnpm
        run: npm install -g pnpm@9
      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install
      - name: Run typecheck
        run: pnpm run typecheck
      - name: Run test
        run: pnpm run coverage
      - name: Upload coverage data
        uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # v5.3.1
        with:
          fail_ci_if_error: true
          disable_search: true
          files: ./coverage/lcov.info
          token: ${{ secrets.CODECOV_TOKEN }}
          verbose: false
  benchmark:
    name: Benchmark
    runs-on: ubuntu-latest

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install pnpm
        run: npm install -g pnpm@9
      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install
      - name: Run benchmark
        run: pnpm run test:bench