checks.yml

---
name: Checks

on:
  pull_request:
  push:
    branches:
      - main

permissions: {}
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}

jobs:
  biome:
    runs-on: ubuntu-24.04-arm

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Biome
        uses: biomejs/setup-biome@4c91541eaada48f67d7dbd7833600ce162b68f51 # v2.7.1

      - name: Run Biome
        run: biome ci .


  dist:
    runs-on: ubuntu-24.04-arm

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          cache: yarn

      - name: Install dependencies
        run: yarn install --immutable

      - name: Build
        run: yarn run build

      - name: Check for differences
        run: git diff --exit-code


  zizmor:
    runs-on: ubuntu-24.04-arm

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
        with:
          advanced-security: false
          annotations: true
          min-severity: low
          persona: pedantic


  all-checks-passed:
    if: always()
    runs-on: ubuntu-24.04-arm

    permissions: {}

    needs:
      - biome
      - dist
      - zizmor

    steps:
      - name: Check if needed jobs succeeded
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
        with:
          jobs: ${{ toJSON(needs) }}