ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: 10.13.1

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      # No sibling checkouts in CI, so assemble links every product to its
      # committed vendor/<product> bundle. A missing bundle fails here with an
      # actionable message rather than silently building a site with no docs.
      - name: Assemble docs sources
        run: pnpm assemble

      - name: Check sitemap consistency
        run: pnpm check:sitemap

      - name: Build
        run: pnpm build

  vendor-guard:
    # vendor/ is written only by the sync-docs action. A human edit here is
    # silently overwritten on the next sync, so reject it at review time.
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Reject hand edits under vendor/
        env:
          BASE: ${{ github.event.pull_request.base.sha }}
          HEAD: ${{ github.event.pull_request.head.sha }}
          AUTHOR: ${{ github.event.pull_request.user.login }}
          HEAD_REF: ${{ github.event.pull_request.head.ref }}
        run: |
          set -euo pipefail
          case "$AUTHOR" in
            *"[bot]"|rivet-docs-sync*) echo "sync bot; skipping"; exit 0 ;;
          esac

          # The sync force-pushes docs-sync/* from scratch every run, so nothing
          # written there by hand survives regardless. Exempt the branch as well
          # as the bot, or a sync PR reopened by a human fails this guard.
          case "$HEAD_REF" in
            docs-sync/*) echo "sync branch; skipping"; exit 0 ;;
          esac

          changed=$(git diff --name-only "$BASE" "$HEAD" -- vendor/ || true)
          if [ -n "$changed" ]; then
            echo "::error::vendor/ is generated by the sync-docs action. Edit the docs in the product repo instead."
            echo "$changed" | sed 's/^/  /'
            exit 1
          fi
          echo "vendor/ untouched"