# Gitea Actions CI for incredigo (self-hosted; remote is gitea only).
# Enforces the non-negotiable green bar: build + vet + race-clean tests. The go
# suite is self-contained (fake gopass/psql binaries, httptest emulators) but needs
# bash + openssl on PATH. Per-package coverage FLOORS are reported, not enforced,
# until rotate/policy/tui are lifted to target (see docs/ROADMAP.md M1).
name: ci
on:
  push:
  pull_request:

jobs:
  build-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install test dependencies (bash + openssl)
        run: |
          apt-get update -y
          apt-get install -y --no-install-recommends bash openssl ca-certificates

      - uses: actions/setup-go@v5
        with:
          go-version: '1.25'
          check-latest: true

      - name: Build
        run: go build ./... && go build -o /tmp/incredigo ./cmd/incredigo

      - name: Vet
        run: go vet ./...

      - name: Test (race)
        run: go test -race ./...

      - name: Coverage report (advisory — floors not yet enforced)
        run: make check-cover || true