name: ForgeFlow quality gate

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: https://gitea.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Secret scan
        shell: bash
        run: |
          set -euo pipefail
          scan_container="$(docker create ghcr.io/trufflesecurity/trufflehog:3.79.0 filesystem /scan --only-verified --fail --no-update)"
          trap 'docker rm -f "${scan_container}" >/dev/null 2>&1 || true' EXIT
          tar --exclude=.git --transform='s#^\.$#scan#;s#^\./#scan/#' -cf - . | docker cp - "${scan_container}:/"
          docker start -a "${scan_container}"

  quality:
    # Browser quality runs against the dedicated bounded Windows 11 VM runner.
    runs-on: windows-native
    steps:
      - uses: https://gitea.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: https://gitea.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      # The native runner deliberately skips Electron's install-time binary
      # download. Prime it once before Node's parallel test workers require
      # Electron, otherwise they can race while creating the same directory.
      - run: npx electron --version
      - run: npm run quality
      - run: npx playwright install chromium
      - run: npm run test:browser:ci
      - name: Preserve browser failure evidence
        if: failure()
        uses: https://gitea.com/actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: forgeflow-browser-failure-evidence
          path: artifacts/
          if-no-files-found: ignore
      - run: npm audit --omit=dev --audit-level=high