.github/workflows/validate.yml

name: Validate distribution package

on:
  pull_request:
  push:
    branches: [main]
    tags: ['v*']

permissions:
  contents: read

jobs:
  package:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - name: Validate, test, and scan package
        run: npm run validate
      - name: Build deterministic release archive
        run: npm run package
      - name: Verify archive does not contain prohibited material
        run: |
          unzip -l dist/wisprs-ai-connectors-v*.zip
          # Scan every packaged file except the scanner itself and the package
          # validator, whose secret-detection patterns would self-match.
          scan_dir="$(mktemp -d)"
          unzip -q dist/wisprs-ai-connectors-v*.zip -d "$scan_dir"
          rm -f "$scan_dir/.github/workflows/validate.yml" "$scan_dir/scripts/validate-package.mjs"
          ! grep -rEa 'BEGIN .*PRIVATE KEY|sk_(live|test)_' "$scan_dir"
      - name: Upload unsigned candidate
        uses: actions/upload-artifact@v4
        with:
          name: wisprs-ai-connectors-${{ github.sha }}
          path: dist/
          if-no-files-found: error
          retention-days: 14