name: CI

on:
  push:
    branches: ["**"]
  pull_request:

jobs:
  check:
    name: Format · Analyze · Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          channel: stable
          flutter-version: 3.44.1
          cache: true

      - name: Flutter version
        run: flutter --version

      - name: Install dependencies
        run: flutter pub get

      # The same quality gate developers run locally:
      # format-check + flutter analyze + the full test suite.
      - name: Quality gate (make check)
        run: make check

      # Fail the build if any dependency is not open source.
      - name: Licence compliance (make licenses)
        run: make licenses

      # Fail the build if a vendored JS bundle drifted from its manifest or a
      # pinned version has a known vulnerability (queries the OSV database).
      - name: Bundled JS security (make deps-check)
        run: make deps-check