name: Tests

on:
  push:
    branches:
      - main
      - develop
  pull_request:
    branches:
      - main
      - develop

jobs:
  test:
    runs-on: ubuntu-latest
    # Zero out GITHUB_TOKEN permissions — tests have no external dependencies and
    # need no credentials. No secrets: references in this workflow either, so no
    # repo secrets are injected into the environment.
    permissions: {}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run unit and integration tests
        run: bun run test