ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  backend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install
        run: pip install -e 'backend[dev]'
      - name: Lint
        run: ruff check backend
      - name: Type check
        working-directory: backend
        run: mypy app
      - name: Tests
        working-directory: backend
        run: pytest -q
      - name: Demo safety
        run: python scripts/validate_demo.py
      - name: Check repository for obvious secrets
        run: |
          ! git grep -En '(BEGIN (RSA|OPENSSH|EC) PRIVATE KEY|gh[pousr]_[A-Za-z0-9]{30,}|AKIA[0-9A-Z]{16})'