name: quant-os-ci

on:
  push:
  pull_request:

jobs:
  deterministic-local:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Validate deterministic Quant OS
        run: bash scripts/validate_all.sh
      - name: Reject generated bundle drift
        run: git diff --exit-code -- dist status/status-data.js
      - name: Reject tracked credential paths
        shell: bash
        run: |
          if git ls-files \
            | grep -E '(^|/)(\.env(\.[^/]+)?|secrets|credentials|userdata_mini)(/|$)' \
            | grep -Ev '(^|/)\.env\.example$'; then
            echo "credential-like tracked path detected"
            exit 1
          fi
      - name: Reject credential-like tracked content
        run: python3 tools/check_tracked_secrets.py