# CI [#832] — pure-Go CLI: fmt, vet, build, secret scan + diagram QA.
# Diagram QA needs chromium: runs only when docs change.
name: ci
on:
  push:
    branches: [main]
  pull_request:
jobs:
  vet:
    runs-on: ultix
    container:
      image: golang:1.23-alpine
    steps:
      - run: apk add --no-cache nodejs git
      - uses: actions/checkout@v4
      - run: gofmt -l cli/ | tee /tmp/fmt.out && test ! -s /tmp/fmt.out
      - run: cd cli && go vet ./... && go build ./...
      - name: secret scan
        run: |
          if grep -rInE "BEGIN (RSA |OPENSSH |EC )?PRIVATE KEY|BW_PASSWORD='|SM_PASSWORD=" --exclude-dir=.git --exclude-dir=.smstate .; then
            echo "::error::secret material committed"; exit 1
          fi
  diagrams:
    runs-on: ultix
    container:
      image: node:20-bookworm
    steps:
      - uses: actions/checkout@v4
      - name: mermaid blocks must parse
        run: |
          apt-get update -qq >/dev/null && apt-get install -qq -y gawk >/dev/null
          # renderer + chromium inside minlag/mermaid-cli; mmdc parses without page render
          QA=$(mktemp -d)
          awk '/^```mermaid/{n++; f=QA"/d"n".mmd"; next} /^```/{f=""; next} f!=""{print > f}' QA="$QA" docs/*.md
          echo '{"args":["--no-sandbox","--disable-setuid-sandbox","--disable-gpu"]}' > "$QA/pptr.json"
          docker_target=skip
          for f in "$QA"/d*.mmd; do
            [ -f "$f" ] || continue
            npx -y @mermaid-js/mermaid-cli@11 -p "$QA/pptr.json" -i "$f" -o /tmp/out.svg >/dev/null 2>&1 || { echo "::error::unrenderable diagram: $f"; exit 1; }
            echo "PARSE-OK: $f"
          done