fix(brand): truth-fix maturity claims + complete oauth-mux de-clone (TIN-2357) #13

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	workflow_dispatch:

	permissions:
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	secrets-scan:
	name: secrets-scan
	runs-on: ubuntu-latest
	timeout-minutes: 15
	steps:
	- uses: actions/checkout@v6
	with:
	fetch-depth: 0

	- uses: cachix/install-nix-action@v31
	with:
	extra_nix_config: \|
	experimental-features = nix-command flakes

	- name: Scan repository for committed secrets
	run: nix develop --command gitleaks detect --source . --redact --verbose

	build-and-test:
	name: build-and-test
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- uses: actions/checkout@v6

	- uses: cachix/install-nix-action@v31
	with:
	extra_nix_config: \|
	experimental-features = nix-command flakes

	- name: Install workspace dependencies
	run: nix develop --command just setup

	- name: Lint, typecheck, and unit tests
	run: nix develop --command just check

	- name: Build static site
	run: nix develop --command just build

	bazel-graph:
	name: bazel-graph
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- uses: actions/checkout@v6

	- uses: cachix/install-nix-action@v31
	with:
	extra_nix_config: \|
	experimental-features = nix-command flakes

	- name: Resolve Bazel module graph
	run: nix develop --command bazelisk mod graph

	- name: Build npm link tree
	run: nix develop --command bazelisk build //:node_modules

Provide feedback