name: ci

on:
  pull_request:
  push:
    branches: [main]

jobs:
  scooling-lab:
    name: scooling lab contract
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - name: Run unittest suite (7 tiers)
        run: PYTHONPATH=src python -m unittest discover -s tests
      - name: Validate provenance schema guardrails
        run: PYTHONPATH=src python -m scooling_lab.provenance --self-check
      - name: Verify dependency BOM is current
        run: PYTHONPATH=src python -m scooling_lab.bom --check --output DEPENDENCIES.md

  secret-scan:
    name: secret scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Install gitleaks
        env:
          GITLEAKS_VERSION: 8.24.3
        run: |
          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o gitleaks.tar.gz
          tar -xzf gitleaks.tar.gz gitleaks
          sudo mv gitleaks /usr/local/bin/gitleaks
          gitleaks version
      - name: Scan for secrets
        run: gitleaks detect --source . --redact