ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  shell-and-security:
    runs-on: macos-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6

      - name: Setup Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.x"

      - name: Install pre-commit
        run: python -m pip install --upgrade pip pre-commit

      - name: Pre-commit checks
        run: pre-commit run --all-files --show-diff-on-failure

      - name: Shell syntax checks
        run: |
          bash -n bootstrap.sh
          bash -n install.sh

      - name: Security scrub (working tree)
        run: python3 scripts/security_scrub.py --no-history