ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Cancel in-progress runs on the same PR / branch when a new push arrives.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  lint:
    uses: ./.github/workflows/_lint.yml
    permissions:
      contents: read

  test:
    uses: ./.github/workflows/_test.yml
    permissions:
      contents: read

  ci-success:
    # Single required-status-check target. Branch protection should require
    # only this job; it summarizes lint + test matrix results so a failure
    # in any matrix cell blocks merge.
    name: "CI Success"
    needs: [lint, test]
    if: always()
    runs-on: ubuntu-latest
    env:
      JOBS_JSON: ${{ toJSON(needs) }}
      RESULTS_JSON: ${{ toJSON(needs.*.result) }}
      EXIT_CODE: ${{!contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') && '0' || '1'}}
    steps:
      - name: Aggregate matrix results
        run: |
          echo "$JOBS_JSON"
          echo "$RESULTS_JSON"
          echo "Exiting with $EXIT_CODE"
          exit $EXIT_CODE