name: CLI package validation

on:
  pull_request:
    paths:
      - 'apps/cli/**'
      - 'libs/**'
      - 'tools/cli-release/**'
      - 'nx.json'
      - 'package.json'
      - 'pnpm-lock.yaml'
      - '.github/actions/setup-workspace/**'
      - '.github/workflows/cli-package.yml'
  push:
    branches:
      - main
      - development
    paths:
      - 'apps/cli/**'
      - 'libs/**'
      - 'tools/cli-release/**'
      - 'nx.json'
      - 'package.json'
      - 'pnpm-lock.yaml'
      - '.github/actions/setup-workspace/**'
      - '.github/workflows/cli-package.yml'

permissions:
  contents: read
  pull-requests: read

concurrency:
  group: cli-package-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  package:
    name: Package on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
          - windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0

      - name: Setup workspace
        uses: ./.github/actions/setup-workspace

      - name: Audit production dependencies
        if: matrix.os == 'ubuntu-latest'
        run: pnpm audit --prod --audit-level high

      - name: Test CLI release-critical paths
        shell: bash
        run: bash tools/cli-release/preflight-tests.sh

      - name: Build, validate, and smoke install package
        run: pnpm nx run cli:smoke-install

      - name: Generate SBOM
        if: matrix.os == 'ubuntu-latest'
        run: npx --yes @cyclonedx/cdxgen --required-only -t js -o dist/apps/cli/cli-sbom.cyclonedx.json

      - name: Upload package validation artifacts
        if: matrix.os == 'ubuntu-latest'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: cli-package-validation
          path: |
            dist/apps/cli/package-validation.json
            dist/apps/cli/package-smoke.json
            dist/apps/cli/cli-sbom.cyclonedx.json
