name: ForgeFlow quality gate

on:
  push:
    branches: [main]
  pull_request:

jobs:
  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Secret scan
        shell: bash
        run: |
          set -euo pipefail
          scan_container="$(docker create ghcr.io/trufflesecurity/trufflehog:3.79.0 filesystem /scan --only-verified --fail --no-update)"
          trap 'docker rm -f "${scan_container}" >/dev/null 2>&1 || true' EXIT
          tar --exclude=.git --transform='s#^\.$#scan#;s#^\./#scan/#' -cf - . | docker cp - "${scan_container}:/"
          docker start -a "${scan_container}"

  quality:
    # Browser quality runs against the dedicated bounded Windows 11 VM runner.
    runs-on: windows-native
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run quality
      - run: npx playwright install chromium
      - run: npm run test:browser:ci
      - name: Preserve browser failure evidence
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: forgeflow-browser-failure-evidence
          path: artifacts/
          if-no-files-found: ignore
      - run: npm audit --omit=dev --audit-level=high