# Stale-anchors gate — server-side backstop for rule-doc-only commits.
#
# ci.yml's audit-matrix runs audit:stale-anchors (via prepublishOnly), but its
# on.push.paths does NOT include docs/internal/*.md / docs/meta-rules.md, so a
# rule-doc-only commit (the exact case this audit guards — heading rename →
# fragment slug drift) wouldn't trigger it. The local pre-commit hook covers
# that, but is bypassable (--no-verify), and Owner-direct-master is the default.
# This job closes that gap.
#
# Zero-install BY DESIGN: audit-stale-anchors.mjs is zero-dep (node: builtins
# only, audit:scripts-stdlib enforced), so no pnpm install — just `node`.
name: Stale Anchors

on:
  push:
    branches: [master]
    paths:
      - 'docs/internal/mockup-conventions.md'
      - 'docs/internal/code-conventions.md'
      - 'docs/internal/design-process.md'
      - 'docs/internal/figma-technical-reference.md'
      - 'docs/meta-rules.md'
      - 'scripts/audit-stale-anchors.mjs'
      - 'package.json'
      - '.github/workflows/stale-anchors.yml'

permissions:
  contents: read

jobs:
  stale-anchors:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Node 20
        uses: actions/setup-node@v5
        with:
          node-version: '20'
          # Zero-install by design (see header): no pnpm on this runner, so disable
          # setup-node@v5's default package-manager-cache, which auto-detects the
          # `packageManager: pnpm@…` field and fails with "Unable to locate pnpm".
          package-manager-cache: false

      - name: Audit stale anchors (offline)
        run: node scripts/audit-stale-anchors.mjs