name: CI

on:
  pull_request:
  push:
    branches: [main]

jobs:
  frozen-install:
    name: Frozen lockfile install
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Node.js 24
        uses: actions/setup-node@v4
        with:
          node-version: '24'
      - name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
        run: corepack enable
      - name: Install dependencies (frozen lockfile)
        run: pnpm install --frozen-lockfile
      - name: Verify workspace groups
        run: pnpm -r list --depth -1

  # E00-S02-T08: the static assertions of tests/secrets-not-embedded.test.mjs
  # gate every PR (the docker-gated layer-scan probe inside the same file runs
  # where a Docker daemon is available and skips cleanly otherwise).
  secrets-not-embedded:
    name: Secrets not embedded (E00-S02-T08)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Node.js 24
        uses: actions/setup-node@v4
        with:
          node-version: '24'
      - name: Run secrets-not-embedded test suite
        run: node --test tests/secrets-not-embedded.test.mjs