ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  lint:
    runs-on: &default-runner ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Install root dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Typecheck
        run: npm run typecheck

  test:
    runs-on: *default-runner
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Install dependencies
        run: npm ci

      - name: Run unified test suite
        run: npm test

      - name: Run coverage suite
        run: npm run test:coverage

  secret-scan:
    runs-on: *default-runner
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install detect-secrets
        run: pip install detect-secrets

      - name: Check for new secrets
        run: |
          # Scan the repo and compare against the audited baseline.
          # Fails if any NEW secrets are found that aren't in the baseline.
          detect-secrets scan \
            --baseline .secrets.baseline \
            --exclude-files 'node_modules/.*' \
            --exclude-files '\.git/.*' \
            --exclude-files 'package-lock\.json'

          # Verify no unaudited secrets remain
          if detect-secrets audit --report --baseline .secrets.baseline 2>&1 | grep -q 'Unaudited'; then
            echo "❌ Unaudited secrets found — run: detect-secrets audit .secrets.baseline"
            exit 1
          fi