ci.yml

name: ci

on:
  push:
  pull_request:

permissions:
  contents: read
  pull-requests: read

jobs:
  metadata-policy:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Validate branch and PR title policy
        env:
          BRANCH_NAME: ${{ github.head_ref }}
          PR_TITLE: ${{ github.event.pull_request.title }}
        run: python3 scripts/validate_publish_metadata.py --branch "$BRANCH_NAME" --pr-title "$PR_TITLE"

  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_ENABLE_COMMENTS: "false"

  test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .[dev]

      - name: Lint
        run: ruff check .

      - name: Test
        run: pytest -m "not integration"