name: Repo Quality

on:
  pull_request:
  push:
    branches:
      - main

jobs:
  structure:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Check required scenario files
        shell: bash
        run: |
          set -euo pipefail
          for scenario in scenarios/*; do
            test -f "$scenario/README.md"
            test -f "$scenario/metadata.yaml"
            test -f "$scenario/sql/99_reset.sql"
            test -f "$scenario/evidence/expected-results.md"
          done

      - name: Check forbidden files
        shell: bash
        run: |
          set -euo pipefail
          if find . -name "*.tfvars" -o -name "*.pem" -o -name "*.key" | grep .; then
            echo "Secret-like files must not be committed."
            exit 1
          fi