name: Validate repository keys and clients
on:
  pull_request:
  push:
    branches: [main]
permissions:
  contents: read
jobs:
  check:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: '22'
          cache: npm
      - run: npm ci
      - name: Install shell test interpreters
        run: |
          if ! command -v busybox >/dev/null || ! command -v shellcheck >/dev/null; then
            sudo apt-get update
            sudo apt-get install -y busybox-static shellcheck
          fi
          busybox sh -c 'echo "BusyBox shell ready"'
          shellcheck --version
      - name: Run unit, shell, and real-browser tests
        run: npm test
        env:
          BROWSER_TESTS: '1'
          BROWSER_ARTIFACTS_DIR: /tmp/quickly-browser-artifacts
      - name: Build isolated test fixture (never deployed)
        run: npm run build:test
      - name: Validate Worker bundle without publishing
        run: npx wrangler deploy --dry-run --config cf-worker/wrangler.toml --outdir /tmp/worker-dry-run
      - name: Upload browser evidence
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: browser-evidence
          path: /tmp/quickly-browser-artifacts
          if-no-files-found: ignore
          retention-days: 7