name: Core Build (no extensions)

on: [pull_request]

jobs:
  core-only:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npm ci
      - name: Verify skill bodies are in sync with the seed migration
        # Fails if a .claude/skills/**/SKILL.md changed without regenerating the
        # seed migration (npm run skills:generate). Keeps prod skill content from
        # silently drifting out of sync. No DB needed — reads files + manifest.
        run: npm run skills:check
      - name: Verify taxonomy registry is in sync with the element lists
        # Fails if dev_docs/bokslut/taxonomi/** changed without regenerating
        # lib/bokslut/ixbrl/taxonomy/generated/ (npm run taxonomy:generate).
        # The iXBRL generator emits facts strictly from the generated registry,
        # so drift here means filings tagged against a stale concept set.
        run: npm run taxonomy:check
      - name: Reset extensions config
        run: echo '{"extensions":[]}' > extensions.config.json
      - run: npm run setup:extensions
      - name: Lint ratchet (no new ESLint errors)
        # `npm run lint` was never wired into CI, so ~60 legacy errors
        # accumulated. This ratchet (sibling of check:guards) fails only when
        # a PR ADDS an error beyond scripts/checks/eslint-baseline.json; the
        # baseline ratchets down as legacy errors get fixed.
        run: npm run check:lint
      - run: npm run build
      - run: npm test
      - name: Antipattern ratchet (no new MFA-bypassing routes / naive öre-rounding)
        # Fails only if a PR ADDS a route that hand-rolls supabase.auth.getUser()
        # instead of the MFA-enforcing guard, or a new Math.round(x*100)/100.
        # Baseline lives in scripts/checks/antipatterns-baseline.json and ratchets
        # down as the A1 (route auth) and D1 (rounding) migrations land.
        run: npm run check:guards
      - name: Check no core imports from extensions
        run: |
          VIOLATIONS=$(grep -r "from '@/extensions/" lib/ app/api/ components/ --include="*.ts" --include="*.tsx" \
            | grep -v "app/api/extensions/" \
            | grep -v "components/extensions/" \
            | grep -v "lib/extensions/_generated/" \
            | grep -v "lib/extensions/loader.ts" || true)
          if [ -n "$VIOLATIONS" ]; then
            echo "ERROR: Core code imports from @/extensions/:"
            echo "$VIOLATIONS"
            exit 1
          fi