name: Coding Plan credential contract
on:
  pull_request:
    paths:
      - 'src/main/zcode/**'
      - 'src/shared/secure-file*'
      - 'src/shared/secure-path-windows-acl*'
      - 'src/shared/windows-security-descriptor*'
      - '.github/workflows/zcode-credential-contract.yml'
  workflow_dispatch:
permissions:
  contents: read
concurrency:
  group: coding-plan-contract-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
jobs:
  credential-files:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, macos-15, windows-2022]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    env:
      ORCA_BACKGROUND_LAUNCH: '1'
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: ./.github/actions/install-node-dependencies
        with:
          native-runtime: node
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version-file: config/.bun-version
      - name: Verify rollback and native Windows permissions
        run: pnpm test src/main/zcode/zcode-plan-api-key-store.test.ts src/main/zcode/zcode-plan-api-key-store-plaintext-rollback.test.ts src/main/zcode/zcode-plan-api-key-store-publication-race.test.ts src/main/zcode/zcode-plan-api-key-store-native-windows.test.ts src/shared/secure-file.test.ts