ci.yml

# Least-privilege GITHUB_TOKEN, SHA-pinned actions, and the merge-blocking gates:
# SAST, secret scan, and `make verify` (lockfile drift, lint, format, types, tests, SCA,
# the HTML-conformance and WCAG checks over the built pages, and the determinism check).
#
# Every action is pinned to the full 40-char commit SHA of its tag, resolved
# 2026-08-07 via `gh api repos/OWNER/REPO/commits/TAG`. Actions stay
# `@<sha> # vX.Y.Z` so the version stays readable next to the pin.
#
# CI never touches the network for data. `data/raw/` is not in the repo, so the
# test suite runs entirely against committed fixtures.
name: ci

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ">=0.11.0"
          python-version: "3.12"

      # `make verify` includes `make pages`, which runs html-validate and axe-core over
      # the pages built from committed fixtures. Nothing is served and nothing is
      # deployed: both checkers read files off disk.
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22"
          cache: npm

      # `make verify` ends in `make determinism`: two builds into two directories,
      # compared by tools/determinism.sh. That check used to be four lines inlined here,
      # and it could not fail. `find` on a missing directory exits 1, but under the
      # default `bash -e` shell without `pipefail` a pipeline reports its last command's
      # status, so the step stayed green; and with no files to hash both sides came out
      # identical, so an empty build passed. The script refuses an empty or missing tree,
      # and tests/test_determinism_gate.py runs it against trees that should fail it.
      - name: make verify (byte-for-byte the local target)
        run: make verify

  secret-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # The action lists the PR's commits to scope its scan to them, which needs
      # pull-requests:read. Read only: it does not write to the PR, see below.
      pull-requests: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      # Comments off so the job needs nothing beyond contents:read. With them on the
      # action asks for pull-requests:write to annotate the PR, and a least-privilege
      # token gets a 403 instead. Findings still fail the job and appear in the log.
      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_ENABLE_COMMENTS: "false"
          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"

  sast:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
      - run: uvx --from semgrep==1.168.0 semgrep scan --error --metrics off --config p/python --config p/javascript --config p/security-audit .