name: CI

on:
  push:
    branches: [ main ]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Compile contracts
        run: npx hardhat compile

      - name: Run tests
        run: npx hardhat test

  secret-scan:
    name: Secret scan
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Scan for leaked secrets
        run: |
          echo "Scanning for private keys, tokens, and sensitive data..."
          FOUND=0
          # Private key patterns (hex 64-char)
          if grep -rn --include='*.ts' --include='*.js' --include='*.sol' --include='*.py' --include='*.json' --include='*.md' -E '0x[0-9a-fA-F]{64}' . --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=artifacts --exclude-dir=cache --exclude-dir=typechain-types; then
            echo "::error::Potential private key found"
            FOUND=1
          fi
          # npm tokens
          if grep -rn 'npm_[A-Za-z0-9]' . --exclude-dir=node_modules --exclude-dir=.git; then
            echo "::error::Potential npm token found"
            FOUND=1
          fi
          if [ $FOUND -eq 1 ]; then
            echo "Review the above matches — false positives from contract addresses are OK."
          else
            echo "✓ No secrets found"
          fi
