ci.yml

name: CI

on:
  push:
    branches: [main, master]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  test:
    name: Lint & test (macOS)
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v5

      - name: Install shellcheck
        run: brew install shellcheck

      - name: Show environment
        run: |
          sw_vers
          bash --version | head -1
          shellcheck --version | sed -n 2p

      # The suite covers syntax, shellcheck, the check registry, the CLI
      # contract, report rendering and the read-only/offline static guards.
      - name: Run the test suite
        run: make check

      # A real audit on the runner: the grade is meaningless on ephemeral
      # hardware, but the exit code and the JSON shape are not. --redact keeps
      # the runner's serial out of the log.
      - name: Smoke run
        run: |
          set +e
          ./bin/macos-security-audit --category encryption,system \
            --json --redact --quiet --output "$RUNNER_TEMP/report.json"
          rc=$?
          set -e
          case "$rc" in
            0|1|2) echo "exit $rc — grade-based, as documented" ;;
            *)     echo "unexpected exit code $rc"; exit 1 ;;
          esac
          python3 -m json.tool "$RUNNER_TEMP/report.json" > /dev/null
          echo "JSON report parses"

  # Not advisory: the script and the suite are clean at shellcheck's strictest
  # level, and a job that is allowed to fail stops telling you anything.
  shellcheck-strict:
    name: shellcheck (style level)
    runs-on: ubuntu-latest
    env:
      SHELLCHECK_VERSION: v0.11.0
    steps:
      - uses: actions/checkout@v5

      # Pinned deliberately. apt's shellcheck lags several releases behind the
      # one this repo is verified against, and the two disagree about which
      # style-level rules fire — so an unpinned strict job fails on a linter
      # upgrade nobody made, on a commit that changed nothing related.
      - name: Install shellcheck ${{ env.SHELLCHECK_VERSION }}
        run: |
          curl -fsSL "https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION}/shellcheck-${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" | tar -xJ
          sudo install "shellcheck-${SHELLCHECK_VERSION}/shellcheck" /usr/local/bin/shellcheck
          shellcheck --version | sed -n 2p

      - run: shellcheck -S style bin/macos-security-audit tests/run-tests.sh