.github/workflows/check.yml

name: check

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Manifests are valid JSON
        run: for f in plugin.json mcp.json .mcp.json .claude-plugin/plugin.json; do jq empty "$f"; done

      - name: Manifests agree on name, version and MCP URL
        run: |
          test "$(jq -r .name plugin.json)" = "$(jq -r .name .claude-plugin/plugin.json)"
          test "$(jq -r .version plugin.json)" = "$(jq -r .version .claude-plugin/plugin.json)"
          test "$(jq -r .mcpServers.heymark.url mcp.json)" = "$(jq -r .mcpServers.heymark.url .mcp.json)"

      - name: Skill text is provider neutral and has no em dashes
        run: |
          if grep -rniE 'claude|anthropic|chatgpt|openai|codex|gpt-' skills/; then exit 1; fi
          if grep -rn '—' skills/ README.md plugin.json .claude-plugin/plugin.json; then exit 1; fi

      - name: Only Markdown, JSON, SVG and repo metadata files
        run: |
          if git ls-files | grep -vE '\.(md|json|svg|yml)$|^LICENSE$|^\.gitignore$'; then exit 1; fi

      - name: Plugin validates
        run: npx --yes @anthropic-ai/claude-code@2.1.288 plugin validate .

      - name: No secrets in history
        run: |
          docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:v8.30.1 git /repo --redact --exit-code 1