verify.yml

# CI du fork : rejoue la validation officielle sur le dépôt privé.
# Chaîne épinglée par la charte : Node.js 24.18.0 exact, pnpm 11.4.0 (corepack lit le
# champ packageManager). Les gates navigateur utilisent le Chrome des runners ubuntu.
name: verify

on:
  pull_request:
  push:
    branches:
      - 'fork/main'
      - 'ci/**'
      - 'chore/**'
      - 'docs/**'
      - 'feat/**'
      - 'fix/**'
      - 'refactor/**'
      - 'release/**'
      - 'sync/**'
      - 'test/**'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: verify-${{ github.ref }}
  cancel-in-progress: true

env:
  COREPACK_ENABLE_DOWNLOAD_PROMPT: '0'

jobs:
  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - run: corepack enable
      - uses: actions/setup-node@v4
        with:
          node-version: 24.18.0
          cache: pnpm
      - name: Install locked dependencies
        run: pnpm install --frozen-lockfile
      - name: Constitutional gates (G0-G14)
        run: pnpm verify
      - name: Compatibility matrix (G7, C0-C3)
        run: pnpm check-compat
      - name: Heritage audit (exceptions register)
        run: pnpm audit-heritage
      - name: Audit accessibilité (D-026)
        run: pnpm audit-a11y
      - name: No diff after rebuild (G9)
        run: git diff --exit-code && test -z "$(git status --porcelain)"
      - name: Gate consommateur (D-024)
        run: node build/fork/check-consumer.js