name: "Lint"

# any branch is useful for testing before a PR is submitted
on: [push, pull_request]

permissions:
  contents: read

jobs:
  lint-package-lock:
    # run on pushes to any branch
    # run on PRs from external forks
    if: |
      (github.event_name != 'pull_request')
      || (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id)
    name: package-lock.json
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout repository
        uses: actions/checkout@v4
      -
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
          cache-dependency-path: |
            src/package-lock.json
            src/bin/doc/package-lock.json
      -
        name: Install lockfile-lint
        run: npm install --no-save lockfile-lint --legacy-peer-deps
      -
        name: Run lockfile-lint on package-lock.json
        run: >
          npx lockfile-lint
          --path src/package-lock.json
          --allowed-hosts npm
          --allowed-schemes https:
          --allowed-schemes github:
          --allowed-urls github:mapbox/node-sqlite3#593c9d498be2510d286349134537e3bf89401c4a