name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  python:
    name: Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13"]
    defaults:
      run:
        working-directory: python
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install
        run: python -m pip install --upgrade pip httpx pytest pytest-asyncio ruff

      - name: Lint
        run: ruff check .

      - name: Test
        run: python -m pytest -q

  node:
    name: Node ${{ matrix.node-version }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        node-version: ["18", "20", "22"]
    defaults:
      run:
        working-directory: node
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}

      - name: Test
        run: node --test

  secrets:
    name: Secret scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Look for committed tokens
        run: |
          if git grep -nIE 'gh[pousr]_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{50,}' -- . ':!.github/workflows/ci.yml'; then
            echo "A GitHub token appears to be committed. Revoke it and remove it from history."
            exit 1
          fi
          echo "No tokens found."