name: IT-0 verify

on:
  push:
  pull_request:

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'
          cache: maven

      - name: Compile and run unit tests
        working-directory: dev/RuoYi-Vue-master
        run: mvn -B -ntp test

      - name: Reject plaintext credentials (IT-0 acceptance #2 / IR-05)
        shell: bash
        run: |
          set -e
          RES=dev/RuoYi-Vue-master/ruoyi-admin/src/main/resources
          if grep -RInE '(password|secret)[[:space:]]*:[[:space:]]*[^$<{[:space:]]' "$RES"; then
            echo "::error::plaintext credential found in resources"
            exit 1
          fi
          if grep -RInE 'APT_DB_PASSWORD[[:space:]]*=[[:space:]]*[^<$[:space:]]' . --exclude-dir=.git; then
            echo "::error::a literal database password is committed"
            exit 1
          fi
          if git ls-files --error-unmatch dev/.env >/dev/null 2>&1; then
            echo "::error::dev/.env must not be tracked"
            exit 1
          fi
          echo "credential scan passed"