code-npm_node-PR_verify.yml

# SPDX-FileCopyrightText: 2026 INDUSTRIA DE DISEÑO TEXTIL S.A. (INDITEX S.A.)
# SPDX-License-Identifier: Apache-2.0

name: code-npm-node-PR-verify

on:
  pull_request:
    types: [opened, synchronize, ready_for_review, reopened]

permissions:
  contents: read

concurrency:
  group: code-npm-node-pr-verify-${{ github.repository }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

env:
  PROJECT_TYPE: ${{ vars.PROJECT_TYPE }}
  WORKING_DIRECTORY: ${{ vars.WORKING_DIRECTORY }}
  PACKAGE_MANAGER: ${{ vars.PACKAGE_MANAGER }}
  ASDF_BRANCH_VERSION: '0.18.0'

jobs:
  verify:
    name: Code / Verify
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: Check out pull request head
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Resolve governed project type
        shell: bash
        run: |
          set -euo pipefail
          descriptor="$GITHUB_WORKSPACE/.github/inditextech-ci-node.json"
          if [[ ! -f "$descriptor" ]]; then
            echo "::error title=Missing descriptor::.github/inditextech-ci-node.json not found."
            exit 1
          fi
          project_type="$(jq -r '.project_type // empty' "$descriptor")"
          case "$project_type" in
            single|workspaces) ;;
            *)
              echo "::error title=Invalid project type::Descriptor .project_type must be single or workspaces."
              exit 1
              ;;
          esac
          workdir="${WORKING_DIRECTORY:-$(jq -r '.working_directory // empty' "$descriptor")}"
          case "$workdir" in
            ""|/*|..|../*|*/..|*/../*)
              echo "::error title=Invalid working directory::WORKING_DIRECTORY must be a non-empty relative repository path." >&2
              exit 1
              ;;
          esac
          if [[ ! -d "$workdir" ]]; then
            echo "::error title=Missing working directory::'${workdir}' is not a directory in this checkout." >&2
            exit 1
          fi
          echo "PROJECT_TYPE=$project_type" >> "$GITHUB_ENV"
          echo "WORKING_DIRECTORY=${workdir}" >> "$GITHUB_ENV"

      - name: Read governed tool versions
        id: tool-versions
        working-directory: ${{ env.WORKING_DIRECTORY }}
        shell: bash
        run: |
          set -euo pipefail
          if grep -Evq '^[a-zA-Z0-9_-]+ [a-zA-Z0-9._+-]+$' .tool-versions; then
            echo "::error title=Invalid tool-versions::${WORKING_DIRECTORY}/.tool-versions is malformed."
            exit 1
          fi
          {
            echo "tool_versions<<EOF"
            cat .tool-versions
            echo
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Set up asdf-managed Node
        uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4.0.1
        with:
          tool_versions: ${{ steps.tool-versions.outputs.tool_versions }}
          asdf_version: ${{ env.ASDF_BRANCH_VERSION }}

      - name: Verify, test, and build
        working-directory: ${{ env.WORKING_DIRECTORY }}
        shell: bash
        run: |
          set -euo pipefail
          case "$PROJECT_TYPE" in
            single|workspaces) : ;;
            *)
              echo "::error title=Invalid project type::PROJECT_TYPE must be single or workspaces."
              exit 1
              ;;
          esac
          case "${PACKAGE_MANAGER:-npm}" in
            npm)
              npm ci
              npm run verify
              ;;
            pnpm)
              corepack enable
              pnpm install --frozen-lockfile
              pnpm run verify
              ;;
            *)
              echo "::error title=Invalid package manager::PACKAGE_MANAGER must be npm or pnpm."
              exit 1
              ;;
          esac