name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

jobs:
  ci:
    name: build + unit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # The runner provides a working docker CLI out of the box (full-dind) — no endpoint
      # resolution needed, same as flight's CI.
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22

      # Job-level dep cache via the runner's built-in cache server. continue-on-error: an
      # unreachable/broken cache server must never break the run (flight convention). npm ci
      # wipes node_modules, so cache npm's own tarball store instead — restoring node_modules
      # would just be deleted again. No explicit save step: caches marked by the restore step
      # are uploaded automatically at job end.
      - name: Restore deps cache
        uses: actions/cache@v4
        continue-on-error: true
        with:
          path: $HOME/.npm
          key: ${{ runner.os }}-deps-npm-${{ hashFiles('package-lock.json') }}

      # Retried: the runner's outbound network/DNS is flaky (transient EAI_AGAIN seen in CI).
      - name: Install dependencies
        run: |
          set -u
          ok=0
          for i in 1 2 3; do
            if npm ci; then ok=1; break; fi
            echo "::warning::dependency install attempt $i/3 failed (likely transient network) — retrying in 5s" >&2
            sleep 5
          done
          [ "$ok" = "1" ] || { echo "::error::dependency install failed after 3 attempts" >&2; exit 1; }

      - name: Build
        run: npm run build

      # vitest auto-appends results to $GITHUB_STEP_SUMMARY when GITHUB_ACTIONS=true — no
      # extra summary step needed (same as flight relies on for its unit stage).
      - name: Unit tests
        run: npm test

      # Verifies the production Dockerfile builds — the deploy path is `docker compose up -d --build`.
      # Build only, nothing runs, so no cleanup/prune steps are needed (unlike flight's e2e stack).
      # Retried: same flaky runner network as dep install.
      - name: Docker image build
        run: |
          set -u
          ok=0
          for i in 1 2 3; do
            if docker compose build --progress=plain; then ok=1; break; fi
            echo "::warning::docker build attempt $i/3 failed (likely transient network) — retrying in 5s" >&2
            sleep 5
          done
          [ "$ok" = "1" ] || { echo "::error::docker image build failed after 3 attempts" >&2; exit 1; }