name: Frontend
on:
    pull_request: null
    push:
        branches:
            - main

concurrency:
    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
    cancel-in-progress: true

permissions: {}

jobs:
    frontend:
        runs-on: ubuntu-latest
        name: Frontend verification
        steps:
            - name: Clone Kimai
              uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
              with:
                  persist-credentials: false

            - name: Setup PNPM
              uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
              with:
                  run_install: false

            - name: Setup Node.js
              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
              with:
                  node-version: 24
                  cache: pnpm
                  cache-dependency-path: pnpm-lock.yaml

            - name: Install frontend dependencies
              run: pnpm install --frozen-lockfile --ignore-scripts

            - name: Check for security issues in frontend dependencies
              run: pnpm audit