From 09a76afa7816927c14510cc210a557441afc3625 Mon Sep 17 00:00:00 2001
From: Miguel Jacq <mig@mig5.net>
Date: Tue, 6 Jan 2026 09:52:28 +1100
Subject: [PATCH] Add CI

---
 .forgejo/workflows/ci.yml | 47 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 .forgejo/workflows/ci.yml

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
new file mode 100644
index 0000000..d97ba4b
--- /dev/null
+++ b/.forgejo/workflows/ci.yml
@@ -0,0 +1,47 @@
+name: CI
+
+on:
+  push:
+
+jobs:
+  test:
+    runs-on: docker
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install system dependencies
+        run: |
+          apt-get update
+          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+            pipx
+
+      - name: Install cspresso
+        run: |
+          pipx install cspresso
+
+      - name: Run cspresso
+        run: |
+           pipx ensurepath
+           . ~/.bashrc
+           cspresso https://cspresso.cafe \
+             --with-deps \
+             --bypass-csp \
+             --ignore-non-html \
+             --evaluate "base-uri 'self'; default-src 'self'; font-src 'self' https://cdn.jsdelivr.net https://fonts.gstatic.com; form-action 'self'; frame-ancestors 'self'; object-src 'none'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'sha256-KrOywPyWP6lMUTRY11kMJQgQms5hqupf9gBFY8o8h/c=' 'sha256-QuPEWNp+rjVYSLUmS8MFUfVHy/Fh3081C+aZBHEczfA=' 'sha256-VUdRP0U3M75/QOdJSB5Paq5D84MZDuIdZAGrzGZgCHg=' 'unsafe-hashes' https://cdn.jsdelivr.net https://fonts.googleapis.com; style-src-attr 'sha256-KrOywPyWP6lMUTRY11kMJQgQms5hqupf9gBFY8o8h/c=' 'sha256-QuPEWNp+rjVYSLUmS8MFUfVHy/Fh3081C+aZBHEczfA=' 'sha256-VUdRP0U3M75/QOdJSB5Paq5D84MZDuIdZAGrzGZgCHg=' 'unsafe-hashes';" \
+             --json
+
+      # Notify if any previous step in this job failed
+      - name: Notify on failure
+        if: ${{ failure() }}
+        env:
+          WEBHOOK_URL: ${{ secrets.NODERED_WEBHOOK_URL }}
+          REPOSITORY: ${{ forgejo.repository }}
+          RUN_NUMBER: ${{ forgejo.run_number }}
+          SERVER_URL: ${{ forgejo.server_url }}
+        run: |
+          curl -X POST \
+               -H "Content-Type: application/json" \
+               -d "{\"repository\":\"$REPOSITORY\",\"run_number\":\"$RUN_NUMBER\",\"status\":\"failure\",\"url\":\"$SERVER_URL/$REPOSITORY/actions/runs/$RUN_NUMBER\"}" \
+               "$WEBHOOK_URL"