ci.yml

name: CI — Lint, Typecheck, Secrets

on:
  pull_request:
    branches:
      - dev
      - main
  push:
    branches:
      - dev
      - main

permissions:
  contents: read

jobs:
  ci:
    name: Lint + Typecheck + Secrets
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      # ⚠️ CRITICAL: Bun only — NEVER use npm/pnpm (per TECHSTACKPREFERENCES.md)
      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: "1.x" # pin to major — avoids breaking changes from Bun 2.x

      - name: Install dependencies
        run: bun install

      # Typecheck nur wenn tsconfig.json existiert
      - name: Typecheck (if TypeScript configured)
        run: |
          if [ -f "tsconfig.json" ]; then
            echo "TypeScript config found — running typecheck..."
            bunx tsc --noEmit
          else
            echo "No tsconfig.json — skipping typecheck"
          fi

      # Biome lint/format nur wenn biome.json existiert
      - name: Biome Check (if configured)
        run: |
          if [ -f "biome.json" ]; then
            echo "Biome config found — running check..."
            bunx @biomejs/biome check .
          else
            echo "No biome.json — skipping Biome check"
          fi

      # Secret Scan — case-insensitive für common patterns
      - name: Scan for hardcoded secrets
        run: |
          # Case-insensitive check for common secret patterns with 20+ char values.
          # Covers: sk- prefixes (OpenAI-style keys), api_key/api-key/API_KEY/API-KEY/
          # client_secret with = or : assignments, values may contain letters, digits,
          # hyphens, underscores, dots.
          # Short values (< 20 chars) are excluded to avoid false positives from
          # module names like 'task-manager', 'publishTask', 'publish-task-model', etc.
          # Lines annotated with "# pragma: allowlist secret" are intentional env-var
          # reads and are excluded from the scan.
          
          # Search in common code directories
          SEARCH_DIRS="Tools .opencode skill-packs"
          
          FOUND=0
          for dir in $SEARCH_DIRS; do
            if [ -d "$dir" ]; then
              if grep -rEin "sk-[a-zA-Z0-9._-]{20,}|(api[_-]?key|client[_-]?secret|password|token)[[:space:]]*[:=][[:space:]]*['\"]?[a-zA-Z0-9._-]{20,}['\"]?" \
                --exclude-dir=node_modules \
                "$dir" --include="*.ts" --include="*.js" 2>/dev/null \
                | grep -v "pragma: allowlist secret"; then
                FOUND=1
              fi
            fi
          done
          
          if [ $FOUND -eq 1 ]; then
            echo "❌ Potential hardcoded secret found!"
            exit 1
          fi
          
          echo "✅ No obvious hardcoded secrets found"

      # Test job — vorbereitet für wenn Tests existieren
      - name: Tests (if tests exist)
        run: |
          if find . -name "*.test.ts" -o -name "*.spec.ts" | grep -q .; then
            echo "Test files found — running tests..."
            bun test
          else
            echo "No test files found — skipping (add tests to enable)"
          fi
        env:
          NODE_ENV: test