quality.yml

name: quality

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: npm
      - run: npm ci
      - run: npx eslint src/ --max-warnings 150
        continue-on-error: true

  secrets:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: scan for leaked secrets
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified
        continue-on-error: true

  ascii-only:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: verify ASCII-only in src/ and tests/
        run: |
          hits=$(LC_ALL=C grep -rnP '[^\x00-\x7F]' src/ tests/ --include='*.js' || true)
          if [ -n "$hits" ]; then
            echo "non-ASCII chars found:"
            echo "$hits" | head -40
            exit 1
          fi
          echo "ASCII-only: clean"