name: APT build checks

on:
  push:
  pull_request:
  workflow_dispatch:

jobs:
  build-checks:
    runs-on: alta-tool-hub-ci
    permissions:
      contents: read
    steps:
      - name: Checkout source
        uses: actions/checkout@v4

      - name: Set up Node.js 22
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: npm

      - name: Install locked dependencies
        run: npm ci

      - name: Run source policy and tests
        run: npm run check

      - name: Audit production dependencies
        run: npm run audit:prod

      - name: Build unpacked Windows application
        run: npm run build-test

      - name: Verify unpacked build and extension policy
        run: node scripts/verify-kit.js --build dist/win-unpacked