Merge pull request 'added pull request check' (#4) from ci/pull-request into main

Reviewed-on: https://codeberg.org/RythonDev/portfolio-roast-bot/pulls/4

.forgejo/workflows/ci.yml

@@ -0,0 +1,46 @@
+name: CI
+
+# pull_request_target always runs this file from the base branch. A pull request
+# cannot replace these steps, which is what `pull_request` would allow after
+# someone clicks Approve on a fork.
+#
+# Forks still are not compiled until a maintainer adds the `ci` label. `cargo
+# check` executes build scripts, so review Cargo.toml, Cargo.lock, build.rs,
+# and .cargo/config.toml before adding it. New commits do not reuse that label;
+# remove it and add it again after reviewing them.
+on:
+    pull_request_target:
+        types: [opened, synchronize, reopened, labeled]
+
+jobs:
+    check:
+        if: |
+            forgejo.event.pull_request.head.repo.full_name == forgejo.repository ||
+            (forgejo.event.action == 'label_updated' && forgejo.event.label.name == 'ci')
+        runs-on: native
+        steps:
+            - name: Checkout pull request
+              uses: https://data.forgejo.org/actions/checkout@v4
+              with:
+                  repository: ${{ forgejo.event.pull_request.head.repo.full_name }}
+                  ref: ${{ forgejo.event.pull_request.head.sha }}
+                  persist-credentials: false
+
+            - name: Cargo check
+              run: |
+                  docker run --rm \
+                      --read-only \
+                      --network bridge \
+                      --cap-drop ALL \
+                      --security-opt no-new-privileges \
+                      --pids-limit 512 \
+                      --memory 4g \
+                      --tmpfs /tmp:rw,nosuid,nodev,size=2g \
+                      --user "$(id -u):$(id -g)" \
+                      -e CARGO_HOME=/tmp/cargo \
+                      -e CARGO_TARGET_DIR=/tmp/target \
+                      -e PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+                      -v "$PWD:/src:ro" \
+                      -w /src \
+                      rust:1.98-bookworm \
+                      cargo check --locked --manifest-path /src/Cargo.toml