name: CI

on:
  pull_request:
  push:
    branches: [main]

jobs:
  test:
    name: Run tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pnpm
        run: npm install -g pnpm@10
      - name: Install dependencies
        run: pnpm install
      - name: Run test suite
        run: pnpm test

  gitleaks:
    name: Secret scan (gitleaks)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install gitleaks
        run: |
          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_arm64.tar.gz -o gitleaks.tar.gz
          tar -xzf gitleaks.tar.gz gitleaks
      - name: Run gitleaks (fail on any hit)
        run: ./gitleaks detect --source . --no-git --redact -v