name: isolated-ci

on:
  push:
  pull_request:

jobs:
  verify:
    # Runner labels/capabilities must be confirmed by the operator before this
    # workflow is considered release evidence. No deployment or secret access is
    # performed by this job.
    runs-on: ubuntu-latest
    container: oven/bun:1.3.14
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Install frozen dependencies
        run: bun install --frozen-lockfile --ignore-scripts
      - name: Unit and integration tests
        run: bun test
      - name: Typecheck
        run: bun run check
      - name: Build fixture application
        run: APP_MODE=demo APP_RELEASE_ID=fixture bun run build
      - name: Release safety checks
        run: APP_MODE=demo APP_RELEASE_ID=fixture bun run release:check
      - name: Isolated fixture smoke
        run: APP_MODE=demo APP_RELEASE_ID=fixture bun run test:fixture
      - name: Strict staging release safety check
        run: >-
          RELEASE_ENV=staging APP_MODE=live
          APP_RELEASE_ID=ci-$(git rev-parse --short HEAD)
          CONVEX_IMAGE=ghcr.io/get-convex/convex-backend@sha256:3aa2ccd6697a75de53948b1ee531d7c9688fe09ef360748d75df46dfc888f69a
          CONVEX_DASHBOARD_IMAGE=ghcr.io/get-convex/convex-dashboard@sha256:63e94c62940a09acd36464e02e1b0a7589f7ef48227003de78510f9523bb4e6b
          bun run release:check

  container:
    # Requires a runner with Docker/Compose. This job is prepared but remains
    # unverified until Gitea reports an actual compatible runner.
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Validate Compose expansion
        run: docker compose config --quiet
      - name: Build immutable web artifact
        run: docker build --build-arg APP_RELEASE_ID=fixture --tag eve-intelligence:fixture .