validate.yml

name: Validate

# Runs the framework's pre-commit hooks against the full tree on every push
# and pull request, so contributions that bypass lefthook locally
# (--no-verify, fork PRs, web edits) are still gated by the same logic.

on:
  push:
    branches: [main, next]
  pull_request:
    branches: [main, next]

permissions:
  contents: read

jobs:
  lefthook:
    name: lefthook (framework-local checks)
    runs-on: ubuntu-latest
    env:
      LEFTHOOK_CHILD: "1"
      CI: "true"
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22"

      - name: Install pnpm
        run: |
          corepack enable
          corepack prepare pnpm@latest --activate

      - name: Cache pnpm store
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.local/share/pnpm/store
          key: pnpm-${{ runner.os }}-${{ hashFiles('package.json') }}
          restore-keys: pnpm-${{ runner.os }}-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile=false --ignore-scripts

      - name: Install cli dependencies
        # cli/ is a self-contained project (own lockfile, not a pnpm workspace
        # member) — the root install above never touches it, but the
        # cli-biome/cli-typecheck pre-commit hooks below need cli/node_modules
        # to exist or they fail outright ("biome: not found").
        run: cd cli && pnpm install --frozen-lockfile

      - name: Run pre-commit hooks against the full tree
        run: pnpm exec lefthook run pre-commit --all-files --force