name: ci

on:
  push:
    branches: [main]
  pull_request:

jobs:
  lint-test-leaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # gitleaks needs full history

      - uses: astral-sh/setup-uv@v5
        with:
          python-version: "3.12"

      - name: Install (locked)
        run: uv sync --frozen

      - name: Lint (ruff)
        run: uv run ruff check .

      - name: Migrations smoke test (SQLite)
        run: uv run alembic upgrade head

      - name: Tests (pytest)
        run: uv run pytest

      - name: Secret scan (gitleaks, full history)
        run: |
          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar -xz gitleaks
          ./gitleaks detect --source . --log-opts="--all" -v