feat: code-signing & VirusTotal scan infrastructure; release v1.3.2 #37

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	concurrency:
	group: ci-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	# ── Job 1: Static validation ─────────────────────────────────────────────
	validate:
	name: Validate manifests & scripts
	runs-on: ubuntu-latest
	permissions:
	contents: read
	env:
	FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- run: git submodule update --init tools prebuilt
	- name: Lint
	run: bash ci/lint.sh
	- name: Validate
	run: bash ci/test.sh

	# ── Job 2: Server binary health check ────────────────────────────────────
	server-health:
	name: Server health (${{ matrix.os }})
	runs-on: ${{ matrix.os }}
	needs: validate
	permissions:
	contents: read
	env:
	FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
	strategy:
	fail-fast: false
	matrix:
	include:
	- os: ubuntu-latest
	binary: prebuilt/bin/devkit-server-linux-amd64
	- os: windows-latest
	binary: prebuilt/bin/devkit-server-windows-amd64.exe
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- run: git submodule update --init tools prebuilt
	- name: Smoke test
	shell: bash
	env:
	DEVKIT_BINARY: ${{ matrix.binary }}
	run: bash ci/smoke.sh

Provide feedback