ci.yml

name: CI
on:
  push:
  pull_request:
  schedule:
    - cron: "3 4 * * 5"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 26

      - name: Install dependencies
        run: npm ci

      - name: Lint files
        continue-on-error: true
        run: npm run lint -- --formatter github

      - name: npm pack (publish) dry run
        continue-on-error: true
        run: npm pack --dry-run

      - name: JSR publish dry run
        continue-on-error: true
        run: npx jsr publish --dry-run

  test-node:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        node-version: [22, 24, 26, latest]
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ matrix.node-version }}

      - name: Install dependencies
        run: npm ci

      - name: Run unit tests on Node.js
        run: npm run test:unit:node

  test-bun:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0

      - name: Install dependencies
        run: bun install

      - name: Run unit tests on Bun
        run: npm run test:unit:bun

  test-deno:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup Deno
        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4

      - name: Install dependencies
        run: deno install

      - name: Run unit tests on Deno
        run: npm run test:unit:deno

  coverage:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 26

      - name: Install dependencies
        run: npm ci

      - name: Run mutation tests and send coverage
        run: npm run test:coverage -- --reporters clear-text,dashboard
        env:
          STRYKER_DASHBOARD_API_KEY: ${{ secrets.STRYKER_DASHBOARD_API_KEY }}

  analyze:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          languages: javascript

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

      - name: Run Snyk to check for vulnerabilities
        # Ne pas exécuter Snyk sur les forks, car ils n'ont pas accès au jeton.
        if: ${{ 'Actions' == github.secret_source }}
        uses: snyk/actions/node@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --sarif-file-output=snyk.sarif

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6

      - name: Upload SARIF files to GitHub Code Scanning
        if: ${{ '' != hashFiles('*.sarif') }}
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          sarif_file: .

  # Exécuter l'analyse OpenSSF Scorecard séparément, car l'action
  # ossf/scorecard-action impose des restrictions sur le job.
  # https://github.com/marketplace/actions/ossf-scorecard-action#workflow-restrictions
  openssf:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
      # Ajouter cette permission pour le OpenID Connect (OIDC) nécessaire pour
      # publier les résultats de l'analyse OpenSSF Scorecard.
      id-token: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Run OpenSSF Scorecard analysis
        # Exécuter Scorecard uniquement sur la branche principale, car les
        # autres branches ne sont pas gérées.
        if: ${{ github.event.repository.default_branch == github.ref_name }}
        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
        continue-on-error: true
        with:
          results_file: scorecard.sarif
          results_format: sarif
          publish_results: true

      - name: Upload SARIF files to GitHub Code Scanning
        if: ${{ '' != hashFiles('*.sarif') }}
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          sarif_file: .