# PERMANENT cross-tenant isolation tripwire (INV1) — see docs/PLAN_RELAY_AUTH_ISOLATION.md T13.
#
# This job MUST be a REQUIRED status check. A green build is impossible if cross-tenant isolation
# regresses (device A reaching host B). DO NOT delete, skip, or make this non-required. If it ever
# goes red, BLOCK the merge (CRITICAL per code-review.md).
name: relay-tripwire

on:
  push:
  pull_request:

jobs:
  cross-tenant-tripwire:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: relay-auth
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: Install relay-auth (+ local relay-contracts)
        run: npm install
      - name: Strict typecheck
        run: npx tsc --noEmit
      - name: THE cross-tenant tripwire (A -> B must be 403)
        run: npx vitest run tripwire/cross-tenant
      - name: Full relay-auth suite
        run: npx vitest run