# OAM fleet CI [#784] — same gate as pre-commit: shellcheck + secret scan + rule audit.
# Uniform across KNEL OAM repos (single-branch main until dev/release split lands).
name: ci
on:
  push:
    branches: [main]
  pull_request:
jobs:
  audit:
    runs-on: ultix
    container:
      image: node:20-bookworm
    steps:
      - uses: actions/checkout@v4
      - name: install shellcheck
        run: apt-get update -qq >/dev/null && apt-get install -qq -y shellcheck git >/dev/null
      - name: secret scan
        run: |
          if grep -rInE "BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY|aws_secret_access_key *=|AKIA[0-9A-Z]{16}" --exclude-dir=.git .; then
            echo "::error::secret material committed"; exit 1
          else
            echo "secret scan clean"
          fi
      - name: rule audit (framework check-rules)
        run: bash scripts/check-rules.sh --fast