Add Gitea CI/CD workflow

2026-06-26 18:23:17 +02:00
parent 8b69dfbafb
commit 85b0a3fa42
2 changed files with 287 additions and 0 deletions
@@ -0,0 +1,84 @@
+name: CI - Build & Verify
+run-name: CI ${{ gitea.ref_name }} by @${{ gitea.actor }}
+
+concurrency:
+  group: vtubeawards-ci-${{ gitea.ref }}
+  cancel-in-progress: true
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  backend:
+    name: Backend (.NET)
+    runs-on: linux
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '8.0.x'
+
+      - name: Restore
+        run: dotnet restore Backend/Backend.csproj
+
+      - name: Build
+        run: dotnet build Backend/Backend.csproj --no-restore --configuration Release
+
+  frontend:
+    name: Frontend (Vue/TS)
+    runs-on: linux
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Install dependencies
+        run: npm ci
+        working-directory: frontend
+
+      - name: Build
+        run: npm run build
+        working-directory: frontend
+
+  hygiene:
+    name: Repository Hygiene
+    runs-on: linux
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Reject tracked build output
+        run: |
+          set -euo pipefail
+          tracked="$(git ls-files frontend/dist Backend/bin Backend/obj || true)"
+          if [ -n "$tracked" ]; then
+            echo "Build output is tracked and must be removed:"
+            echo "$tracked"
+            exit 1
+          fi
+
+      - name: Secret pattern scan
+        run: |
+          set -euo pipefail
+          hits="$(
+            grep -RInE '(SECRET|TOKEN|PASSWORD|API_KEY)[[:space:]]*[:=][[:space:]]*.{8,}' \
+              --include='*.cs' \
+              --include='*.ts' \
+              --include='*.vue' \
+              Backend frontend/src 2>/dev/null || true
+          )"
+          if [ -n "$hits" ]; then
+            echo "Possible hardcoded secret found:"
+            echo "$hits"
+            exit 1
+          fi