ci.yml

---
name: CI

"on":
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  PYTHON_VERSION: "3.11"

jobs:
  validate:
    name: Validate Plugin
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Validate plugin structure
        run: |
          echo "Checking plugin manifest..."
          test -f .claude-plugin/plugin.json || exit 1
          echo "Plugin manifest exists"

          echo "Checking command frontmatter..."
          for cmd in commands/*.md; do
            grep -q "^---" "$cmd" || exit 1
          done
          echo "Commands have frontmatter"

          echo "Checking skill frontmatter..."
          for skill in skills/*/SKILL.md; do
            grep -q "^---" "$skill" || exit 1
          done
          echo "Skills have frontmatter"

  lint:
    name: Lint
    runs-on: ubuntu-latest
    needs: validate
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install ruff

      - name: Lint Python files
        run: ruff check hooks/

  format:
    name: Format Check
    runs-on: ubuntu-latest
    needs: validate
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install ruff

      - name: Check formatting
        run: ruff format --check hooks/

  test:
    name: Test
    runs-on: ubuntu-latest
    needs: [lint, format]
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install pytest

      - name: Run tests
        run: |
          if [ -d "tests" ]; then
            pytest tests/ -v || echo "No tests found"
          else
            echo "No tests directory, skipping"
          fi

      - name: Validate hooks execute
        run: |
          for hook in hooks/*.py; do
            echo "Checking $hook syntax..."
            python -m py_compile "$hook"
          done
          echo "All hooks have valid syntax"

  security:
    name: Security Audit
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Check for secrets
        run: |
          echo "Checking for hardcoded secrets..."
          grep -rn "password\s*=\s*['\"]" hooks/ || true
          grep -rn "api_key\s*=\s*['\"]" hooks/ || true
          echo "Secret check complete"