name: pr-build
on: [pull_request]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
  cancel-in-progress: true

jobs:
  build:
    name: lint and build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          # The job runs PR-authored code (npm ci, npm run build); nothing in it
          # talks to a remote, so no token needs to sit in the workspace.
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Lint MDX heading hierarchy
        run: npm run lint:mdx

      - name: Build
        run: npm run build