name: Static Analysis
on:
    pull_request: {}
    push:
        branches: [develop, master]
permissions: {} # No permissions needed
jobs:
    ts_lint:
        name: "Typescript Syntax Check"
        runs-on: ubuntu-24.04
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  persist-credentials: false

            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  node-version-file: package.json
                  cache: "pnpm"

            # Does not need branch matching as only analyses this layer
            - name: Install Deps
              run: "pnpm install --frozen-lockfile"

            - name: Typecheck
              run: "pnpm run lint:types"

    i18n_lint:
        name: "i18n Check"
        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
        permissions:
            pull-requests: read
        with:
            hardcoded-words: "Element"
            packageManager: pnpm

    js_lint:
        name: "ESLint"
        runs-on: ubuntu-24.04
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  persist-credentials: false

            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  node-version-file: package.json
                  cache: "pnpm"

            # Does not need branch matching as only analyses this layer
            - name: Install Deps
              run: "pnpm install --frozen-lockfile"

            - name: Run Linter
              run: "pnpm run lint:js"

    workflow_lint:
        name: "Workflow Lint"
        runs-on: ubuntu-24.04
        permissions:
            security-events: write
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  persist-credentials: false

            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  node-version-file: package.json
                  cache: "pnpm"

            # Does not need branch matching as only analyses this layer
            - name: Install Deps
              run: "pnpm install --frozen-lockfile"

            - name: Run Linter
              run: "pnpm lint:workflows"

            - name: Run zizmor
              uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2

    analyse_dead_code:
        name: "Analyse Dead Code"
        runs-on: ubuntu-24.04
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  persist-credentials: false

            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  node-version-file: package.json
                  cache: "pnpm"

            - name: Install Deps
              run: "pnpm install --frozen-lockfile"

            - name: Run linter
              run: "pnpm run lint:knip"