ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  python:
    name: lint / type / test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Install dev dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"

      - name: ruff
        run: ruff check .

      - name: mypy (best-effort during phase 0)
        run: |
          if [ -d src/ycai ] && [ -n "$(find src/ycai -name '*.py' -not -empty)" ]; then
            mypy src/ycai
          else
            echo "no source yet — phase 0"
          fi

      - name: pytest
        run: pytest -q

  secret-scan:
    name: secret scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python (for detect-secrets)
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install detect-secrets
        run: pip install detect-secrets

      - name: Custom regex sweep
        run: bash scripts/secret_scan.sh

      - name: gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  publish-check:
    name: publish hygiene
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: publish-check
        run: bash scripts/publish_check.sh