name: PR Checks

on:
  pull_request:
    branches: [master]
  push:
    # INFRA-F40: gate master 直推（Owner 默认直 commit master）。
    # 原 `branches-ignore: [master]` 把 master 排除在外，反而漏掉最该闸的落点。
    branches: [master]

jobs:
  checks:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v3
        with:
          version: 10.28.2

      - name: Setup Node 22
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Typecheck (vue-tsc --noEmit)
        run: pnpm exec vue-tsc --noEmit

      - name: Unit tests (vitest)
        run: pnpm test

      - name: Design system audits (prepublishOnly gates)
        run: pnpm run prepublishOnly

      - name: Upstream understanding-analysis gate (支柱④)
        # chokepoint-bound：artifact 存在才校，无则 no-op PASS。纯 node 校验，Gitea runner 无 root 亦可跑。
        run: pnpm audit:upstream-gate

      # INFRA-F40 注：数值 render-verification gate 需 chromium（系统库），这台 Gitea
      # runner 以普通用户跑、无 root 装不了系统库 → 该 gate 改在 GitHub `publish.yml`
      # 的 render-gate job 跑（GitHub 托管 runner 自带 root + --with-deps），release 时
      # 把守"不发漂移包"。本地任意机器可 `pnpm test:render-verification && pnpm audit:render-drift-gate`。