# CI [#824] — vet + build + secret scan; image builds are done by the lane
# (digest-pinned push) per the compose/lifecycle house rules.
name: ci
on:
  push:
    branches: [main]
  pull_request:
jobs:
  vet:
    runs-on: ultix
    container:
      image: golang:1.23-alpine
    steps:
      - run: apk add --no-cache nodejs
      - uses: actions/checkout@v4
      - run: gofmt -l . | tee /tmp/fmt.out && test ! -s /tmp/fmt.out
      - run: go vet ./...
      - run: go build ./...
      - name: secret scan
        run: |
          apk add --no-cache grep >/dev/null 2>&1 || true
          if grep -rInE "BEGIN (RSA |OPENSSH |EC )?PRIVATE KEY|user_token [A-Za-z0-9]{20,}" --exclude-dir=.git .; then
            echo "::error::secret material committed"; exit 1
          fi