ci.yml

name: verify

on:
  push:
    branches: [main]
  pull_request:

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build the demo image
        run: docker compose build

      - name: Lint, type-check, and test (the same Compose verification boundary)
        run: docker compose run --rm verify

      - name: Run the one-shot secure demo over real HTTP
        run: docker compose run --rm demo

      - name: Reset to fresh state
        # The demo's well-formed import mutates the secure container's fixtures; the
        # comparison needs both apps to start from identical fresh state.
        run: docker compose down --volumes --remove-orphans

      - name: Run the vulnerable-vs-secure read comparison (opt-in)
        run: ALLOW_VULNERABLE_DEMO=true docker compose --profile vulnerable run --rm compare

      - name: Tear down
        if: always()
        run: docker compose --profile vulnerable down --volumes --remove-orphans