rescript-deno-ci.yml

# SPDX-License-Identifier: MPL-2.0
name: ReScript/Deno CI
on:
  push:
    branches: [main, master]
  pull_request:

# Estate guardrail: scope push to default branches so a PR fires once (not
# push+PR), and cancel superseded runs. Safe — read-only PR-triggered check.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    branches: [main, master]
  pull_request:
permissions:
  contents: read
jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4.1.1
      - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
        with:
          deno-version: v1.x
      - name: Deno lint
        run: deno lint
      - name: Deno fmt check
        run: deno fmt --check
      - name: Deno test
        run: deno test --allow-all --coverage=coverage
      - name: ReScript build
        run: |
          if [ -f "rescript.json" ] || [ -f "bsconfig.json" ]; then
            npm install
            npx rescript
          fi
      - name: Type check
        run: deno check **/*.ts || true
  security:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4.1.1
      - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
      - name: Check permissions
        run: |
          # Audit for dangerous permissions
          grep -rE "allow-run|allow-write|allow-env" . || echo "No dangerous permissions"