name: isolated-ci

on:
  push:
  pull_request:

jobs:
  verify:
    # Runner labels/capabilities must be confirmed by the operator before this
    # workflow is considered release evidence. No deployment or secret access is
    # performed by this job.
    runs-on: ubuntu-latest
    container: oven/bun:1.3.14
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Install frozen dependencies
        run: bun install --frozen-lockfile --ignore-scripts
      - name: Unit and integration tests
        run: bun test
      - name: Typecheck
        run: bun run check
      - name: Build fixture application
        run: APP_MODE=demo APP_RELEASE_ID=fixture bun run build
      - name: Release safety checks
        run: APP_MODE=demo APP_RELEASE_ID=fixture bun run release:check
      - name: Isolated fixture smoke
        run: APP_MODE=demo APP_RELEASE_ID=fixture bun run test:fixture

  container:
    # Requires a runner with Docker/Compose. This job is prepared but remains
    # unverified until Gitea reports an actual compatible runner.
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Validate Compose expansion
        run: docker compose config --quiet
      - name: Build immutable web artifact
        run: docker build --build-arg APP_RELEASE_ID=fixture --tag eve-intelligence:fixture .