fix: audit — session key, transaction safety, auth dedup, tests #145

	name: CI

	on:
	push:
	branches: ["main"]
	pull_request:
	branches: ["main"]

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	env:
	MIX_ENV: test

	jobs:
	test:
	name: Test
	runs-on: ubuntu-latest

	services:
	postgres:
	image: postgres:17
	env:
	POSTGRES_USER: postgres
	POSTGRES_PASSWORD: postgres
	POSTGRES_DB: crit_test
	ports:
	- 5432:5432
	options: >-
	--health-cmd pg_isready
	--health-interval 10s
	--health-timeout 5s
	--health-retries 5

	steps:
	- uses: actions/checkout@v6

	- name: Set up Elixir
	uses: erlef/setup-beam@v1
	with:
	elixir-version: "1.19"
	otp-version: "28"

	- name: Restore dependencies cache
	uses: actions/cache@v5
	with:
	path: deps
	key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.lock') }}
	restore-keys: ${{ runner.os }}-mix-

	- name: Install dependencies
	run: mix deps.get

	- name: Check formatting
	run: mix format --check-formatted

	- name: Compile (warnings as errors)
	run: mix compile --warnings-as-errors

	- name: Security audit (Sobelow)
	run: mix sobelow --skip

	- name: Dependency audit
	run: mix deps.audit

	- name: Run tests
	run: mix test
	env:
	DATABASE_URL: postgres://postgres:postgres@localhost/crit_test

Provide feedback