security: untrack production env file (#49) #56

	name: CI

	on:
	pull_request:
	push:
	branches:
	- main

	permissions:
	contents: read

	jobs:
	repository-hygiene:
	name: Repository hygiene
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	- name: Reject tracked production env files
	run: \|
	if git ls-files --error-unmatch .env.production >/dev/null 2>&1; then
	echo "::error::.env.production must not be tracked. Use .env.production.example plus deployment secrets."
	exit 1
	fi

	api:
	name: Rust API
	runs-on: ubuntu-latest
	defaults:
	run:
	working-directory: api
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	- name: Install Rust toolchain
	uses: dtolnay/rust-toolchain@stable
	- name: Install native dependencies
	run: sudo apt-get update && sudo apt-get install -y pkg-config libssl-dev
	- name: Cache cargo artifacts
	uses: Swatinem/rust-cache@v2
	with:
	workspaces: api
	- name: Check
	run: cargo check --all-targets
	- name: Test
	run: cargo test --all-targets

	dashboard:
	name: Dashboard
	runs-on: ubuntu-latest
	defaults:
	run:
	working-directory: dashboard
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	- name: Set up Vite+
	uses: voidzero-dev/setup-vp@v1
	with:
	cache: true
	- name: Install dependencies
	run: vp install
	- name: Check
	run: vp check
	- name: Build
	run: vp build

	python:
	name: Python scripts
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: '3.11'
	cache: pip
	- name: Install dependencies
	run: pip install -r requirements.txt
	- name: Compile Python sources
	run: python -m compileall -q .

Navigation Menu