name: repo-checks

on:
  workflow_call:

jobs:
  build-test:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      NODE_OPTIONS: --max-old-space-size=4096
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-ci

      - name: Verify codex-rs Cargo manifests inherit workspace settings
        run: python3 .github/scripts/verify_cargo_workspace_manifests.py

      - name: Verify codex-tui does not import codex-core directly
        run: python3 .github/scripts/verify_tui_core_boundary.py

      - name: Verify Bazel clippy flags match Cargo workspace lints
        run: python3 .github/scripts/verify_bazel_clippy_lints.py

      - name: Test Codex package builder
        run: python3 -m unittest discover -s scripts/codex_package -p 'test_*.py'

      - name: Test standalone installer
        run: python3 -m unittest discover -s scripts/install -p 'test_*.py'

      - name: Test macOS notarization
        run: python3 -m unittest discover -s .github/scripts/macos-signing -p 'test_notarize_with_akv.py'

      - name: Setup pnpm
        uses: pnpm/action-setup@a8198c4bff370c8506180b035930dea56dbd5288 # v5
        with:
          run_install: false

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: 22

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Ensure root README.md contains only ASCII and certain Unicode code points
        run: ./scripts/asciicheck.py README.md
      - name: Check root README ToC
        run: python3 scripts/readme_toc.py README.md

      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
        with:
          version: "0.11.3"
      - name: Check formatting (run `just fmt` to fix)
        run: just fmt-check

      - name: Prettier (run `pnpm run format:fix` to fix)
        run: pnpm run format

      - name: Check for a clean worktree
        if: always() && !cancelled()
        uses: ./.github/actions/check-clean-worktree