From a9a1c201e7f6ed9055ac3c937f3b3d64ca2080ae Mon Sep 17 00:00:00 2001
From: Fi3w0 <alex.lazarevych@icloud.com>
Date: Thu, 20 Aug 2026 20:09:24 +0200
Subject: [PATCH] ci: add secret scan and Go checks for the GitHub mirror

The deploying pipeline stays on Forgejo, where the runner can reach the cluster.
This one only scans for secrets and runs vet, test and lint, so the mirrored
repo shows its own checks without ever needing a secret. Go steps no-op until
apps/api/go.mod exists.
---
 .github/workflows/ci.yml | 76 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..0c1c242
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,76 @@
+# CI that runs on the GitHub mirror.
+#
+# The real pipeline lives in .forgejo/workflows and does the building, the
+# registry push and the deploy, because only the Forgejo runner can reach the
+# cluster. This workflow deliberately does none of that. It exists so the
+# repository a reviewer opens on GitHub shows its own green checks, and so a
+# secret can never reach the mirror unnoticed.
+#
+# No secrets are consumed here and none are needed.
+
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  secrets:
+    name: secret scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      # Run as a plain container rather than a marketplace action, so the same
+      # command works unchanged on the Forgejo runner.
+      - name: gitleaks
+        run: |
+          docker run --rm -v "$PWD:/repo" \
+            ghcr.io/gitleaks/gitleaks:v8.30.1 \
+            detect --source /repo --redact -v
+
+  go:
+    name: vet, test, lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      # The API is written by a separate agent. Until it lands there is no
+      # go.mod, and this job should pass rather than fail on an empty tree.
+      - id: probe
+        run: |
+          if [ -f apps/api/go.mod ]; then
+            echo "ready=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "ready=false" >> "$GITHUB_OUTPUT"
+            echo "apps/api/go.mod not present yet, skipping Go checks" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - uses: actions/setup-go@v7
+        if: steps.probe.outputs.ready == 'true'
+        with:
+          go-version-file: apps/api/go.mod
+          cache-dependency-path: apps/api/go.sum
+
+      - name: vet and test
+        if: steps.probe.outputs.ready == 'true'
+        working-directory: apps/api
+        run: |
+          go vet ./...
+          go test -race ./...
+
+      - uses: golangci/golangci-lint-action@v9
+        if: steps.probe.outputs.ready == 'true'
+        with:
+          working-directory: apps/api