CI: R parse check and secret scan

.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  r-parse:
+    name: R parse check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: r-lib/actions/setup-r@v2
+        with:
+          r-version: "4.4"
+      - name: Parse all R source files
+        run: Rscript scripts/check_parse.R
+
+  secrets:
+    name: Secret scan (advisory)
+    runs-on: ubuntu-latest
+    # Advisory for now: known secret-hygiene items (dev cookie password, the
+    # committed dev users.sqlite) are being addressed separately. Once those are
+    # cleared, remove continue-on-error to make this a blocking gate.
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install gitleaks
+        run: |
+          VERSION=8.21.2
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /tmp gitleaks
+          sudo mv /tmp/gitleaks /usr/local/bin/gitleaks
+      - name: Scan for secrets
+        run: gitleaks detect --source . --redact --no-banner

scripts/check_parse.R

@@ -0,0 +1,29 @@
+#!/usr/bin/env Rscript
+# Syntax-check every R source file in the repo. This does not evaluate the code
+# (no packages required) — it only confirms each file parses, catching the kind
+# of syntax break that would otherwise only surface when the app is launched.
+
+# all.files = FALSE (the default) already skips dot-dirs such as .git
+files <- list.files(".", pattern = "\\.R$", recursive = TRUE, full.names = TRUE)
+
+failed <- character(0)
+for (f in files) {
+  ok <- tryCatch(
+    {
+      parse(f)
+      TRUE
+    },
+    error = function(e) {
+      message("PARSE FAIL: ", f)
+      message("  ", conditionMessage(e))
+      FALSE
+    }
+  )
+  if (!ok) failed <- c(failed, f)
+}
+
+if (length(failed) > 0) {
+  message("\n", length(failed), " file(s) failed to parse.")
+  quit(status = 1)
+}
+cat("All", length(files), "R files parsed OK\n")