on:
  pull_request:
concurrency: policy
permissions:
  contents: read
jobs:
  verify:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Redact evidence
        id: redact-evidence
        if: always()
        run: |
          go run ./integration/agentcompat/cmd/redact --output "$RUNNER_TEMP/nezha-agentcompat-redacted"
          cp raw-secret "$RUNNER_TEMP/nezha-agentcompat-redacted/raw-secret"
      - uses: actions/upload-artifact@v6
        if: always()
        with:
          path: ${{ runner.temp }}/nezha-agentcompat-redacted