name: CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  # Only the mapping check lives here. Cloudflare Workers Builds already runs
  # `wrangler types && tsc --noEmit` as its build command, on every branch, so
  # duplicating the typecheck bought a second copy of the same signal.
  #
  # What Workers Builds does not do is compare the control mappings against the
  # docs — and that check needs no Cloudflare credentials, which is why it can
  # live here and the migration guard cannot.
  mappings:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version: '26'

      # No install step: check-mappings.mjs has no dependencies. It applies the
      # migrations to an in-memory SQLite database using Node's built-in module
      # and diffs the resulting control_mappings against
      # docs/framework-mapping.md, rationale text included.
      - name: Control mappings match the docs
        run: node scripts/check-mappings.mjs