node.js.yml

# Clean install, build and test on the one Node version this repo builds with.
#
# There is deliberately no version matrix. What ships is a browser bundle — Node
# is only the toolchain, and nothing consumes this repo as an npm package, so
# there is no compatibility surface to test across versions. A matrix was worse
# than useless here: it tested 22 and 24 while the workflow that actually builds
# the released package pinned 22 and everyone developed on 24, so the toolchain
# that produced the artifact was the one nobody looked at.
#
# The version lives in .nvmrc, which `nvm use` reads locally as well.

name: Node.js CI

# Least privilege for the GITHUB_TOKEN. This job only reads the repo — nothing
# here pushes, comments or releases. Declared at workflow level so any job added
# later starts read-only too. Without this the token inherits the repository
# default, which is read-write, and actions/checkout leaves it in .git/config
# where every later step (npm ci, Build.ps1, npm test) could use it.
permissions:
  contents: read

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  # Fallback for release-please.yml. The Release PR does fire `pull_request`,
  # but GitHub parks that run at `action_required` — the repo's fork-PR approval
  # policy is `first_time_contributors` and the PR's author,
  # github-actions[bot], trips it. release-please.yml approves the parked run,
  # which is the normal path and puts the check on the PR where it belongs. If
  # that approval is ever refused it dispatches this workflow instead, since
  # workflow_dispatch is never gated.
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7
      - name: Use Node.js from .nvmrc
        uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: "npm"
      - name: Install Xvfb
        # Xvfb is needed by the Playwright extension-smoke step: MV3 service
        # workers do not surface in Playwright's headless mode, so the e2e
        # tests run headed inside a virtual display (see docs/architecture/testing.md).
        #
        # PowerShell is deliberately NOT installed here: ubuntu-latest ships pwsh
        # preinstalled, which is why publish-chrome-web-store.yml calls
        # `pwsh -File ./Build.ps1` with no install step of its own. The `shell:
        # pwsh` Build step below and the build smoke test in `npm test` both use
        # that preinstalled copy.
        run: |
          sudo apt-get update
          sudo apt-get install -y xvfb
      - name: Install dependencies
        run: npm ci --include=optional
      - name: Typecheck
        run: npm run typecheck
      - name: Format check
        # Prettier only agrees with a local run on an LF working tree, which is
        # what .gitattributes (`* text=auto eol=lf`) guarantees on every
        # platform. Without it a Windows checkout gets CRLF files and this step
        # would pass in CI while failing for the developer on every single file.
        run: npm run format:check
      - name: Build
        shell: pwsh
        run: |
          .\Build.ps1
      # - run: npm run build --if-present
      - run: npm test --if-present
      - name: Install Playwright Chromium
        # .npmrc sets ignore-scripts=true, so the browser download must be
        # explicit. --with-deps installs the required system libraries.
        run: npx playwright install --with-deps chromium
      - name: Extension smoke + behaviour (Playwright)
        # Reuses the unpacked/ built by the Build step above.
        run: xvfb-run --auto-servernum npm run test:e2e