From 6d165898785bbee9a283daf277ce63c4d927adda Mon Sep 17 00:00:00 2001
From: sax3l <simon@siax.io>
Date: Tue, 10 Nov 2026 10:29:22 +0100
Subject: [PATCH] =?UTF-8?q?fix(security):=20ta=20bort=20d=C3=B6d=20GitHub?=
 =?UTF-8?q?=20Actions-CI=20(SEC-25)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Varför: .github/workflows/ci.yml återställdes av recovery-commit 3d2fc6f
('restore source removed by production documentation merge'). 0pt är
Gitea-first: den aktiva pipelinen är .gitea/workflows/ci.yml, och
.github-varianten är en divergerad kopia som blir körbar först om någon
registrerar en GitHub-runner. Doctor-kontrollen SEC-25 flaggar den.

Ändring: filen borttagen. Ingen funktionalitet förlorad — Gitea-varianten
är kanalisk och orörd.

Verifiering: doctor --repo . -> SEC-25 PASS.
---
 .github/workflows/ci.yml | 59 ----------------------------------------
 1 file changed, 59 deletions(-)
 delete mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
deleted file mode 100644
index 73a27fd..0000000
--- a/.github/workflows/ci.yml
+++ /dev/null
@@ -1,59 +0,0 @@
-name: CI
-
-# Quality gate: typecheck + test on every PR and non-main push.
-# 0pt previously relied solely on the Vercel build with no pre-merge gate.
-# Build is intentionally NOT run here because it needs runtime secrets
-# (POSTGRES_URL, ENGINE_URL, STRIPE, RESEND) — Vercel owns the build; CI owns
-# the static gate.
-#
-# Updated by the GitHub<->Gitea unification merge (2026-07-28). The note that
-# used to sit here — "lint is not a step because this repo has no eslint
-# dependency or config wired" — is no longer true: the Gitea line's Wave 2
-# hardening added eslint + typescript-eslint + a flat config and repointed the
-# "lint" script at `eslint src tests`. Lint now runs, ADVISORY
-# (continue-on-error), matching .gitea/workflows/ci.yml: the v0-generated
-# legacy tree carries pre-existing lint noise, so it must not block merges.
-#
-# `typecheck` (BLOCKING) is tsc over tsconfig.check.json = src/ + tests/.
-# `typecheck:app` (ADVISORY) is the whole-repo tsc this workflow used to run as
-# its blocking step. It was green on the GitHub line alone but reports 9
-# pre-existing errors on the unified tree (app/api/0pt/* route handlers, where
-# the Wave 2 Zod schemas type fields as plain `string` while the services want
-# narrower unions). It is kept running, and kept visible, rather than deleted —
-# see package.json's "//scripts" note. Flip it back to blocking once those 9
-# are cleared.
-#
-# Python engine (services/api) is gated separately if/when a Python workflow
-# is added.
-on:
-  pull_request:
-  push:
-    branches-ignore: [main]
-
-concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  gate:
-    name: Typecheck + test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-      - name: Enable corepack (pnpm)
-        run: corepack enable
-      - name: Install (frozen lockfile)
-        run: pnpm install --frozen-lockfile
-      - name: Typecheck (tsc over src/ + tests/ -- blocking)
-        run: pnpm run typecheck
-      - name: Test (vitest -- blocking)
-        run: pnpm run test
-      - name: Typecheck whole repo (advisory -- 9 pre-existing app/ errors)
-        continue-on-error: true
-        run: pnpm run typecheck:app
-      - name: Lint (eslint -- advisory; legacy tree has pre-existing noise)
-        continue-on-error: true
-        run: pnpm run lint
-- 
2.54.0