CI¶

This project uses Forgejo Actions for continuous integration. All CI steps run in containers built from distroless base images.

Workflows¶

Workflow	Triggers	What it does
`ci.yaml`	push, pull_request	Lint/tests, Quasar build, Android APK, dependency SBOM (syft), vulnerability scan (grype), license check (grant), docs build
`pages.yaml`	push to `dev`	Builds mkdocs and deploys to the `pages` branch (CodeFloe Pages)

CI images¶

Defined in containers/ and published to the CodeFloe container registry (codefloe.com/st4713/nfcscreen-app:build|security|docs). The hosted Forgejo Actions runner runs each job in its own Docker-in-Docker environment, so the jobs reference the images by their full registry URL. Rebuild and re-push them after changing a Dockerfile:

CODEFLOE_TOKEN=... containers/ensure-images.sh

Images:

build — JDK 21, Node, Android SDK (lint/test/build jobs)
security — syft, grype, grant, cosign (security jobs)
docs — mkdocs-material (docs job)

All final stages are distroless Debian 13 (with busybox + git as a deliberate exception for Forgejo Actions).

Local equivalent¶

The Makefile mirrors the CI steps for local development:

make ci          # everything
make test-driver # driver Gradle tests
make test-app    # app Vitest tests
make build-app   # Quasar SPA
make build-android  # Android APK
make sbom        # syft SBOM
make vulnscan    # grype scan
make docs        # mkdocs build

Setting up the runner¶

See Setup the CI runner.