code-npm_node-PR_verify.yml

# SPDX-FileCopyrightText: 2026 INDUSTRIA DE DISEÑO TEXTIL S.A. (INDITEX S.A.)
# SPDX-License-Identifier: Apache-2.0

name: code-npm-node-PR-verify

on:
  pull_request:
    types: [opened, synchronize, ready_for_review, reopened]

permissions:
  contents: read

concurrency:
  group: code-npm-node-pr-verify-${{ github.repository }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

env:
  PROJECT_TYPE: ${{ vars.PROJECT_TYPE }}
  WORKING_DIRECTORY: ${{ vars.WORKING_DIRECTORY }}
  PACKAGE_MANAGER: ${{ vars.PACKAGE_MANAGER }}
  ASDF_BRANCH_VERSION: '0.18.0'

jobs:
  verify:
    name: Code / Verify
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: Check out pull request head
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Read governed tool versions
        id: tool-versions
        working-directory: ${{ env.WORKING_DIRECTORY }}
        shell: bash
        run: |
          set -euo pipefail
          # Reject any .tool-versions line that is not a strict "<plugin> <version>" before asdf reads it (npm is pinned via package.json packageManager, not here).
          if grep -Evq '^[a-zA-Z0-9_-]+ [a-zA-Z0-9._+-]+$' .tool-versions; then
            echo "::error title=Invalid tool-versions::${WORKING_DIRECTORY}/.tool-versions is malformed."
            exit 1
          fi
          {
            echo "tool_versions<<EOF"
            cat .tool-versions
            echo
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Set up asdf-managed Node
        uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4.0.0
        with:
          tool_versions: ${{ steps.tool-versions.outputs.tool_versions }}
          asdf_version: ${{ env.ASDF_BRANCH_VERSION }}

      - name: Verify, test, and build
        working-directory: ${{ env.WORKING_DIRECTORY }}
        shell: bash
        run: |
          set -euo pipefail
          # One install resolves the whole workspace; `verify` runs the governed lifecycle (lint, unit tests, build) across the tree.
          case "$PROJECT_TYPE" in
            single|workspaces) : ;;
            *)
              echo "::error title=Invalid project type::PROJECT_TYPE must be single or workspaces."
              exit 1
              ;;
          esac
          # Package manager defaults to npm; an absent PACKAGE_MANAGER var renders the npm path unchanged (byte-identical to the pre-pnpm template).
          case "${PACKAGE_MANAGER:-npm}" in
            npm)
              npm ci
              npm run verify
              ;;
            pnpm)
              # Corepack activates the exact pnpm pinned in the product's package.json "packageManager" field: no floating pnpm, no product edit.
              corepack enable
              pnpm install --frozen-lockfile
              pnpm run verify
              ;;
            *)
              echo "::error title=Invalid package manager::PACKAGE_MANAGER must be npm or pnpm."
              exit 1
              ;;
          esac