# CI — master-push gate (system-review-2026-06-10 P1-02).
#
# publish.yml only fires on tag push / workflow_dispatch, so before this file
# existed nothing server-side guarded master pushes: Owner-direct-master is the
# default commit path and the local pre-commit hook is bypassable (--no-verify).
# This runs the same audit-matrix as publish.yml on every master push that
# touches gate-relevant paths; docs-only commits skip (no audit surface).
#
# Kept as a separate workflow instead of widening publish.yml's `on.push`:
# a `paths:` filter there would also apply to tag pushes (risking silently
# un-triggered releases), and publish.yml's `if: github.event_name == 'push'`
# publish-job guard would match branch pushes too.
name: CI

on:
  push:
    branches: [master]
    paths:
      - 'src/**'
      - 'scripts/**'
      - 'figma-sync/**'
      - 'figma-data/**'
      - 'eslint-plugin/**'
      - 'playground/docs/**'
      - 'templates/**'
      - 'package.json'
      - 'pnpm-lock.yaml'
      - 'docs/STATUS.md'
      - 'docs/internal/backlog.md'
      - 'CHANGELOG.md'
      - '.github/workflows/**'

permissions:
  contents: read

jobs:
  # P1-06 (system-review-2026-06-10): a11y visibility for v1.0 DoD (d).
  # Non-blocking BY DESIGN (owner decision 2026-06-10): 43 color-contrast
  # violations are tracked designer-pending debt (V1_RELEASE_CHECKLIST), so a
  # hard gate would keep master permanently red. Flip to blocking by removing
  # `continue-on-error` once the contrast debt clears. The full axe-core run
  # (test:a11y) stays in publish.yml's a11y-report job — release-time signal;
  # this push-time job runs only the cheap offline token-pair report.
  a11y-report:
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10.28.2

      - name: Setup Node 20
        uses: actions/setup-node@v5
        with:
          node-version: '20'
          cache: 'pnpm'

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Token contrast report (non-blocking)
        run: pnpm run audit:token-contrast

  audit-matrix:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        node-version: ['20', '22']
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10.28.2

      - name: Setup Node ${{ matrix.node-version }}
        uses: actions/setup-node@v5
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'pnpm'

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Run prepublishOnly gates
        run: pnpm run prepublishOnly