# Exercise 1 — A CI workflow for a Node/TypeScript service (medium)
#
# Save as .github/workflows/ci.yml in a repo with:
#   package.json scripts: lint, typecheck, test, build ; package-lock.json
#   tests need PostgreSQL 16 via DATABASE_URL
#
# Requirements:
#   STEP 1: trigger on pull requests and on pushes to main.
#   STEP 2: cancel in-progress runs for the same ref when a new commit arrives.
#   STEP 3: default token permissions: read-only contents.
#   STEP 4: job `checks` (ubuntu-24.04): checkout, setup-node 22 with npm cache,
#           `npm ci`, then lint and typecheck.
#   STEP 5: job `test` (needs checks): matrix over Node 20 and 22; a postgres:16
#           service container with a health check; run tests with coverage and
#           DATABASE_URL pointing at the service.
#   STEP 6: job `build` (needs test): `npm run build`, upload `dist/` as an
#           artifact named `dist-${{ github.sha }}` retained 7 days.
#   STEP 7: pin third-party actions by full commit SHA (placeholders like
#           actions/checkout@<40-char-sha> # v4 are fine) — explain in a
#           comment why tags are risky.
#
# No code self-check — verify against the CHECKLIST at the bottom (e.g. with
# `actionlint` and by opening a PR).

name: ci

on:
  # TODO STEP 1

concurrency:
  # TODO STEP 2

permissions:
  # TODO STEP 3

jobs:
  checks:
    # TODO STEP 4

  test:
    # TODO STEP 5

  build:
    # TODO STEP 6

# STEP 7 comment:
#

# ---------------------------------------------------------------------------
# CHECKLIST:
# [ ] `actionlint` reports no errors.
# [ ] Opening a PR runs checks → test (2 matrix jobs) → build, in that order.
# [ ] Pushing a second commit to the PR cancels the first run.
# [ ] The test job waits for Postgres to be healthy before running tests.
# [ ] npm downloads are cached between runs (setup-node cache: npm).
# [ ] The dist artifact appears on the run page with a 7-day retention.
# [ ] No job has write permissions it doesn't need.
# [ ] Third-party actions are pinned by commit SHA with a version comment.
# ---------------------------------------------------------------------------