.node-common:
  image: node:trixie-slim
  variables:
    npm_config_cache: "$CI_PROJECT_DIR/.npm-cache"
  cache:
    key:
      files:
        - package-lock.json
    paths:
      - .npm-cache/
  before_script:
    - node --version

security_checker:
  extends: .node-common
  script:
    - npm audit --audit-level=moderate
  allow_failure: false

test:
  extends: .node-common
  script:
    - npm install
    - npm run build
    - npm run test

build:
  extends: .node-common
  script:
    - npm install
    - npm run build
  artifacts:
    paths:
      - packages/*/dist/
      - node_modules/
    expire_in: 1 hour

lint:
  extends: .node-common
  script:
    - npm install
    - npm run build # required by eslint import plugin
    - npm run lint

test-integration:
  extends: .node-common
  script:
    - npm install
    - npm run build
    - npm run test:integration --workspace=@wizardconnect/wallet

publish:
  extends: .node-common
  # npm trusted publishing via GitLab OIDC — no NPM_TOKEN needed.
  # Each @wizardconnect/* package must be linked to this GitLab project
  # on npmjs.com: package Settings > Publishing access > Trusted publishers.
  tags:
    - saas-linux-small-amd64 # force gitlab instance runner (not self hosted)
  id_tokens:
    NPM_ID_TOKEN:
      aud: "npm:registry.npmjs.org"
    SIGSTORE_ID_TOKEN:
      aud: sigstore
  script:
    - apt-get update && apt-get install -y git
    - node contrib/auto-publish.js
  rules:
    - if: $CI_COMMIT_BRANCH == "master"
  needs:
    - test
    - lint

pages:
  image: python:3-slim
  cache:
    key: pages-pip
    paths:
      - .pip-cache/
  variables:
    PIP_CACHE_DIR: "$CI_PROJECT_DIR/.pip-cache"
  script:
    - pip install zensical
    - zensical build
    - mv site public
  artifacts:
    paths:
      - public
  rules:
    - if: $CI_COMMIT_BRANCH == "master"

force-publish:
  extends: .node-common
  tags:
    - saas-linux-small-amd64 # force gitlab instance runner (not self hosted)
  id_tokens:
    NPM_ID_TOKEN:
      aud: "npm:registry.npmjs.org"
    SIGSTORE_ID_TOKEN:
      aud: sigstore
  script:
    - apt-get update && apt-get install -y git
    - node contrib/force-publish.js
  rules:
    - if: $CI_COMMIT_BRANCH == "master"
      when: manual
  allow_failure: false