name: CI

on:

push:

branches: [ "main", "develop" ]

pull_request:

branches: [ "main", "develop" ]

# Minimal token permissions — principle of least privilege.

permissions:

contents: read

pull-requests: read

concurrency:

group: ${{ github.workflow }}-${{ github.ref }}

cancel-in-progress: true

jobs:

build-and-test:

runs-on: ubuntu-latest

steps:

# Pin to full commit SHA to prevent supply-chain attacks via mutable tags.

- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

with:

fetch-depth: 0

- name: Set up Go

uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0

with:

go-version: '1.25'

cache: true

- name: Set up Node.js

uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0

with:

node-version: '20'

cache: 'npm'

cache-dependency-path: './web/package-lock.json'

- name: Verify version metadata

run: bash scripts/check-version.sh

- name: Build Frontend

working-directory: ./web

run: |

npm ci

npm run build

- name: Test Go Backend

run: go test -v ./...

- name: Build Go Backend

run: go build -v -o aptify ./cmd/server

# ── Security checks ────────────────────────────────────────────────────────

- name: Go vulnerability check (govulncheck)

run: |

go install golang.org/x/vuln/cmd/govulncheck@latest

govulncheck ./...

- name: Go security lint (gosec)

run: |

go install github.com/securego/gosec/v2/cmd/gosec@latest

gosec ./...

- name: Frontend dependency audit

working-directory: ./web

# Fail on high or critical npm advisory severity.

run: npm audit --audit-level=high

- name: Secret scanning (gitleaks)

uses: gitleaks/gitleaks-action@44c470ffc35caa8b1eb3e8012ca53c2f9bea4eb5 # v2.3.6

env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}