# `.github/workflows/`

GitHub Actions parallel preset. GitLab CI (`.gitlab-ci.yml`) is the primary; these workflows let GitHub-mirrored deploys stay green.

| Workflow      | Trigger               | Does                                                             |
| ------------- | --------------------- | ---------------------------------------------------------------- |
| `ci.yml`      | push/PR to `main`     | validate + test (.NET + Node) + security + package per app       |
| `codeql.yml`  | push/PR + weekly cron | Static analysis (TS/C#) — feeds GitHub Security alerts           |
| `release.yml` | push tag `v*.*.*`     | Drafts a GitHub Release from the matching `CHANGELOG.md` section |

## Secrets used

| Name                   | Where set | What for                          |
| ---------------------- | --------- | --------------------------------- |
| `GITHUB_TOKEN`         | auto      | `ghcr.io` login, gitleaks, codeql |
| (no others by default) | —         | Production deploy stays on GitLab |

Add per-environment secrets via GitHub Environments if you start deploying from here too.
