donutbrowser/.github/workflows/pr-checks.yml

name: Pull Request Checks

on:
  pull_request:
    branches: ["main"]
  merge_group:
    branches: ["main"]

permissions:
  security-events: write
  contents: read
  actions: read

jobs:
  lint-js:
    name: Lint JavaScript/TypeScript
    uses: ./.github/workflows/lint-js.yml
    permissions:
      contents: read

  lint-rust:
    name: Lint Rust
    uses: ./.github/workflows/lint-rs.yml
    permissions:
      contents: read

  security-scan:
    name: Security Vulnerability Scan
    if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@8deb546fdb875b9996d27d4950be7312dac076a1" # v2.5.0
    with:
      scan-args: |-
        -r
        --skip-git
        --lockfile=pnpm-lock.yaml
        --lockfile=src-tauri/Cargo.lock
        ./

  # E2E suites deliberately do not run here. They need real credentials, Docker,
  # and a desktop session, which CI could not supply reliably. They are run
  # locally instead; see the E2E section of AGENTS.md.

  pr-status:
    name: PR Status Check
    runs-on: ubuntu-latest
    needs: [lint-js, lint-rust, security-scan]
    if: always()
    steps:
      - name: Check all jobs succeeded
        run: |
          if [[ "${{ needs.lint-js.result }}" != "success" || "${{ needs.lint-rust.result }}" != "success" || "${{ needs.security-scan.result }}" != "success" ]]; then
            echo "One or more checks failed"
            exit 1
          fi
          echo "All checks passed!"