ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run typecheck
      - run: npm run lint
      - run: npm audit --omit=dev
      - run: npm run test
      - run: npx playwright test
      # Point 10: Fail if secrets are detected (simple grep for now, would use specialized tools in real env)
      - name: Secret Scan
        run: |
          if grep -rE "AIza[0-9A-Za-z-_]{35}|sk_live_[0-9a-zA-Z]{24}" . --exclude-dir=.git --exclude=ci.yml --exclude=firebase.ts; then
            echo "Potential secrets detected in codebase!"
            exit 1
          fi