ci.yml

name: CI

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [18, 20, 22]
    steps:
      - uses: actions/checkout@v4

      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Validate JSON
        run: |
          node --input-type=module <<'EOF'
          import fs from 'node:fs';
          import path from 'node:path';

          const files = ['opencode.json'];
          for (const name of fs.readdirSync('config')) {
            if (name.endsWith('.json')) files.push(path.join('config', name));
          }

          let failed = false;
          for (const file of files) {
            try {
              JSON.parse(fs.readFileSync(file, 'utf8'));
              console.log(`OK: ${file}`);
            } catch (error) {
              failed = true;
              console.error(`FAIL: ${file}: ${error.message}`);
            }
          }
          if (failed) process.exit(1);
          EOF

      - name: Validate agent permissions
        run: bash scripts/validate-agent-configs.sh

      - name: Check routing defaults
        run: node scripts/check-routing-defaults.mjs

      - name: Check budget configuration
        run: npm run validate:budget

      - name: Check feature integration contract
        id: feature-contract
        shell: bash
        run: |
          set +e
          npm run validate:feature 2>&1 | tee feature-contract.log
          status=${PIPESTATUS[0]}
          set -e
          exit "$status"

      - name: Upload feature-contract diagnostics
        if: failure() && matrix.node-version == 22
        uses: actions/upload-artifact@v4
        with:
          name: feature-contract-node-22
          path: feature-contract.log

      - name: Check documentation links
        run: node scripts/check-doc-links.mjs

      - name: Run tests
        run: npm test

      - name: Check for obvious credentials
        shell: bash
        run: |
          set -euo pipefail
          matches=$(grep -rEnI \
            --exclude-dir=.git \
            --exclude-dir=node_modules \
            --exclude='package-lock.json' \
            '(gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9]{20,}|-----BEGIN ([A-Z ]+ )?PRIVATE KEY-----)' \
            . || true)
          if [ -n "$matches" ]; then
            echo "Potential credentials found:"
            echo "$matches"
            exit 1
          fi
          echo "No obvious credentials detected."

  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Reject committed environment files
        shell: bash
        run: |
          set -euo pipefail
          files=$(find . -type f -name '.env*' ! -name '.env.example' ! -path './.git/*' -print)
          if [ -n "$files" ]; then
            echo "Environment files must not be committed:"
            echo "$files"
            exit 1
          fi
          echo "No committed environment files found."