name: Secrets guard (env backups)

on:
  pull_request:
  push:
    branches:
      - main
      - master
      - develop

jobs:
  env-backup-guard:
    name: Ensure no tracked env backup files
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: "Guard: no tracked env backups"
        run: node scripts/guard-no-tracked-env-backups.mjs