ci.yml

name: CI

on:
  push:
    branches: [master, main]
  pull_request:

jobs:
  links:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Lychee link check
        uses: lycheeverse/lychee-action@v2
        with:
          args: >-
            --no-progress
            
            --exclude-loopback
            --max-redirects 5
            --accept '200..=204,206,301..=308,403,429'
            './**/*.md'
          fail: true

  leak-guard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Scan for accidental leaks
        shell: bash
        run: |
          set -e
          PATTERN='UNKNOWN @ file://|/home/[a-z][a-z0-9_-]+/(orchestrator|models)/|sk-ant-api03-[A-Za-z0-9_-]{20,}|sk-proj-[A-Za-z0-9_-]{20,}|-----BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----'
          if git ls-files | grep -vE '^\.github/workflows/' | xargs -r grep -EHn "$PATTERN" 2>/dev/null; then
            echo "::error::Leak guard found suspicious patterns above"
            exit 1
          fi
          echo "Leak guard clean"