name: MarginCI
on: [pull_request]
permissions:
  contents: read
jobs:
  marginci:
    name: MarginCI
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      # Fail closed, rather than a skipped job that can satisfy a required check.
      - name: Reject untrusted fork execution
        if: github.event.pull_request.head.repo.full_name != github.repository
        run: |
          echo 'INCONCLUSIVE: fork PRs require a separately reviewed trusted-branch comparison.'
          exit 2
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '25.3.0'
      - name: Install the reviewed locked dependencies
        run: npm ci --ignore-scripts --no-audit --no-fund
      - name: Compare PR head against the event base commit
        run: |
          mkdir -p .marginci
          ./node_modules/.bin/marginci test research --against "$MARGINCI_BASE_SHA" --json > .marginci/ci-report.json
        env:
          MARGINCI_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          FIRECRAWL_API_KEY: ${{ secrets.FIRECRAWL_API_KEY }}
          EXA_API_KEY: ${{ secrets.EXA_API_KEY }}
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: always() && github.event.pull_request.head.repo.full_name == github.repository
        with:
          name: marginci-report
          include-hidden-files: true
          retention-days: 7
          path: .marginci/ci-report.json
          if-no-files-found: ignore