Prototype commit

.forgejo/workflows/check.yml

@@ -0,0 +1,57 @@
+name: check
+
+on:
+  push:
+    branches: ['**']
+    tags: ['v*']
+  workflow_dispatch:
+
+jobs:
+  frontend:
+    runs-on: nix:host
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install npm dependencies
+        run: nix develop --command bash -c "cd web && npm ci"
+
+      - name: svelte-check
+        run: nix develop --command bash -c "cd web && npm run check"
+
+      - name: Production build
+        run: nix develop --command bash -c "cd web && npm run build"
+
+      - name: Confirm SW + manifest emitted
+        run: |
+          test -f web/build/index.html
+          test -f web/build/service-worker.js
+          test -f web/build/manifest.webmanifest
+          test -f web/build/robots.txt
+
+  server:
+    runs-on: nix:host
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: go vet
+        run: nix develop --command bash -c "cd server && go vet ./..."
+
+      - name: go build
+        run: nix develop --command bash -c "cd server && go build ./..."
+
+      - name: Confirm strict mode refuses to start without secrets
+        run: |
+          set +e
+          nix develop --command bash -c "cd server && DOCENT_PASSWORD=t go run . -strict -addr :0" 2>&1 | tee /tmp/strict.log
+          status=${PIPESTATUS[0]}
+          if [ "$status" -eq 0 ]; then
+            echo "expected -strict to refuse to start without DOCENT_COOKIE_SECRET" >&2
+            exit 1
+          fi
+          grep -q "DOCENT_QR_KEY must be set in -strict mode\|DOCENT_COOKIE_SECRET must be set in -strict mode" /tmp/strict.log