name: Architecture Governance

on:
  push:
    branches:
      - '**'
  pull_request:

jobs:
  architecture:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm

      - name: Install Dependencies
        run: npm ci

      - name: Enforce Boundaries
        run: npm run arch:check

      # Was entirely missing before 2026-08-18: this workflow built and
      # checked boundaries but never ran a single test. karma.conf.js's
      # CHROME_BIN fallback is a Windows path, which the ubuntu-latest
      # runner doesn't have - browser-actions/setup-chrome supplies one
      # and CHROME_BIN below points at it explicitly.
      - name: Setup Chrome
        id: setup-chrome
        uses: browser-actions/setup-chrome@v1

      - name: Unit tests with coverage gate
        env:
          CHROME_BIN: ${{ steps.setup-chrome.outputs.chrome-path }}
        run: npm run test:coverage

      # The production build is what enforces the bundle budget. The initial
      # bundle sits at ~1.55 MB raw against a 700 kB target, so the error
      # threshold is a ratchet, not the goal: it is set just above today's
      # size so the bundle cannot grow while we work it back down. Lower the
      # ratchet in angular.json every time it comes down.
      - name: Build
        run: npm run build

      # Stops payment credentials returning to the browser bundle. See
      # scripts/ci/scan-bundle.sh for what it looks for and why.
      - name: Scan bundle for credentials
        run: npm run scan:bundle

      - name: E2E
        run: |
          npx playwright install --with-deps chromium
          npm run e2e