# CI [#832] — pure-Go CLI: fmt, vet, build, secret scan. No Rust in the chain.
name: ci
on:
  push:
    branches: [main]
  pull_request:
jobs:
  vet:
    runs-on: ultix
    container:
      image: golang:1.23-alpine
    steps:
      - run: apk add --no-cache nodejs git
      - uses: actions/checkout@v4
      - run: gofmt -l cli/ | tee /tmp/fmt.out && test ! -s /tmp/fmt.out
      - run: cd cli && go vet ./... && go build ./...
      - name: secret scan
        run: |
          if grep -rInE "BEGIN (RSA |OPENSSH |EC )?PRIVATE KEY|BW_PASSWORD='|SM_PASSWORD=" --exclude-dir=.git --exclude-dir=.smstate .; then
            echo "::error::secret material committed"; exit 1
          fi