ci: add Gitea Actions pipeline (rust test/clippy + codeberg sync)

.gitea/workflows/ci.yml

@@ -0,0 +1,89 @@
+name: ci
+# CI for souveraine — Rust crate. Tests + clippy on push/PR to primary (dev)
+# and public (published). On push to public, mirror public:public to Codeberg
+# on green. primary stays the private dev branch; public is what publishes.
+#
+# Required repo secrets:
+#   CODEBERG_TOKEN — push to codeberg.org/Fimeg/Souveraine (public branch)
+on:
+  push:
+    branches: [primary, public]
+  pull_request:
+    branches: [primary, public]
+
+jobs:
+  rust-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          components: clippy
+      - name: cargo test
+        run: cargo test
+      - name: cargo clippy
+        run: cargo clippy -- -D warnings
+
+  no-ai-attribution:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+      - name: Check commit messages for AI attribution
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            RANGE="${{ github.event.pull_request.base.sha }}..${{ github.sha }}"
+          else
+            RANGE="${{ github.event.before }}..${{ github.sha }}"
+            if [ "${{ github.event.before }}" = "0000000000000000000000000000000000000000" ]; then
+              RANGE="HEAD~10..HEAD"
+            fi
+          fi
+          # CO assembled from fragments so this guard file does not itself trip
+          # the public-branch pre-commit scanner (which bans the literal token).
+          CO="Co-Authored""-By:"
+          PATTERNS="${CO}.*[Cc]laude|${CO}.*OpenAI|${CO}.*ChatGPT|${CO}.*Copilot|${CO}.*Letta|${CO}.*Cursor|Generated by|Generated with|AI-assisted|Auto-generated by"
+          FAIL=0
+          while IFS= read -r msg; do
+            if echo "$msg" | grep -qiE "$PATTERNS"; then
+              echo "::error::AI attribution found in commit: $msg"
+              FAIL=1
+            fi
+          done < <(git log --format='%s%n%b' $RANGE 2>/dev/null)
+          if [ "$FAIL" -eq 1 ]; then
+            echo "::error::Commits contain AI attribution lines. Remove them before merging."
+            exit 1
+          fi
+          echo "No AI attribution found in commits."
+
+  action-pins:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Check for floating action refs
+        run: |
+          if grep -rE 'uses:.*@(v[0-9]+|stable|main|master)(\s|$)' .gitea/workflows/; then
+            echo "::error::Floating action refs found — pin every action to a commit SHA"
+            exit 1
+          fi
+          echo "All action refs are SHA-pinned."
+
+  # Mirror the published branch only. primary (dev) never reaches Codeberg.
+  sync-codeberg:
+    runs-on: ubuntu-latest
+    needs: [rust-test, no-ai-attribution, action-pins]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/public'
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+      - name: Push public to Codeberg
+        run: |
+          if [ -z "${{ secrets.CODEBERG_TOKEN }}" ]; then
+            echo "[INFO] [sync] CODEBERG_TOKEN not set — skipping codeberg push"
+            exit 0
+          fi
+          git remote add codeberg-ci "https://${{ secrets.CODEBERG_TOKEN }}@codeberg.org/Fimeg/Souveraine.git"
+          git push codeberg-ci public:public
+          echo "Pushed public to codeberg.org/Fimeg/Souveraine"