name: CI

on:
  pull_request:
  push:
    branches: [main]

jobs:
  test:
    name: Run tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install dependencies
        run: pnpm install
      - name: Run test suite
        run: pnpm test

  gitleaks:
    name: Secret scan (gitleaks)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run gitleaks (fail on any hit)
        run: gitleaks detect --source . --no-git --redact -v