ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_call:

permissions:
  contents: read

jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Scan for secrets
        env:
          # Bump together; checksum from
          # https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_checksums.txt
          GITLEAKS_VERSION: 8.30.1
          GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
        run: |
          set -euo pipefail
          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o /tmp/gitleaks.tgz
          echo "${GITLEAKS_SHA256}  /tmp/gitleaks.tgz" | sha256sum -c -
          tar xz -C /tmp -f /tmp/gitleaks.tgz
          /tmp/gitleaks detect --source . --verbose --redact

      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: 'npm'

      - name: Check for large files
        run: |
          LARGE=$(find . -not -path './.git/*' -not -path './node_modules/*' -type f -size +5M)
          if [ -n "$LARGE" ]; then
            echo "::error::Large files detected (>5 MB):"
            echo "$LARGE"
            exit 1
          fi

      - name: Install dependencies
        run: npm ci --ignore-scripts

      - name: Audit high-severity vulnerabilities
        run: npm audit --audit-level=high

      # Reads package-lock.json directly — no extra dependency to install, so
      # the license gate itself adds nothing to the supply chain. Currently the
      # tree is dev-only (nothing from node_modules ships to Pages), but the
      # gate is here so it has teeth the moment you add real dependencies.
      - name: Check licenses
        run: npm run license:check

      # `eslint --cache` writes to .eslintcache at cwd; persist it across
      # runs so warm CI lints incrementally instead of rescanning the tree.
      - name: Restore ESLint cache
        uses: actions/cache@v6
        with:
          path: .eslintcache
          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.js', 'package-lock.json') }}-${{ hashFiles('src/**/*.js', 'functions/**/*.js', 'tests/**/*.js') }}
          restore-keys: |
            eslint-${{ runner.os }}-${{ hashFiles('eslint.config.js', 'package-lock.json') }}-
            eslint-${{ runner.os }}-

      - name: Lint
        run: npm run lint

      - name: Test
        run: npm test

      - name: Build contract
        run: npm run build