From 34308c5615460bc58b24b8b1b77ec402af469118 Mon Sep 17 00:00:00 2001
From: Christian Cleberg <hello@cleberg.net>
Date: Wed, 18 Mar 2026 20:51:12 -0500
Subject: implement security scans in builds

---
 .build.yml | 37 ++++++++++++++++++++++++++++++++++---
 1 file changed, 34 insertions(+), 3 deletions(-)

diff --git a/.build.yml b/.build.yml
index b053d7c..3a34af7 100644
--- a/.build.yml
+++ b/.build.yml
@@ -1,14 +1,45 @@
 image: alpine/edge
 oauth: pages.sr.ht/PAGES:RW
+
 packages:
   - hut
+  - git
+  - ca-certificates
+  - gitleaks
+  - swift
+
 sources:
   - https://git.sr.ht/~ccleberg/Hutch
+
 environment:
   site: hutch.cleberg.net
+
 tasks:
-  - package: |
+  - security-secrets: |
+      set -euo pipefail
+      cd Hutch
+      gitleaks git --redact --verbose .
+
+  - security-deps-lockfile: |
+      set -euo pipefail
+      cd Hutch
+      swift package resolve --only-use-versions-from-resolved-file
+
+  - test: |
+      set -euo pipefail
+      cd Hutch
+      swift test --parallel
+
+  - build: |
+      set -euo pipefail
+      cd Hutch
+      swift build -c release
+
+  - package-site: |
+      set -euo pipefail
       cd Hutch/website
       tar -cvz . > ../../site.tar.gz
-  - upload: |
-      hut pages publish -d $site site.tar.gz
+
+  - upload-site: |
+      set -euo pipefail
+      hut pages publish -d "$site" site.tar.gz
-- 
cgit v1.2.3