CI: move workflow to .github and use a subpath-aware checkout

actions/checkout drops the /git subpath of our Gitea when building the
clone URL. Use ischanx/checkout v6.0.2, pinned to its commit.

.github/workflows/ci.yml

@@ -0,0 +1,32 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node: [22, 24]
+    steps:
+      # Upstream actions/checkout builds the clone URL from the server's origin
+      # and drops a subpath such as /git (actions/checkout#1370, #1242), so it
+      # cannot clone from imsc.uni-graz.at/git. ischanx/checkout keeps the path.
+      # Pinned to the commit of its v6.0.2 tag; its v4 tags lack the fix.
+      - uses: ischanx/checkout@b3a7a36c84c480d7e1a6f9f7ca7bb55dc519f0ba # v6.0.2
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 11
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run ci

DEVELOPMENT.md

@@ -82,5 +82,16 @@ As of November 2026, `gpt-5-nano` and `gpt-4.1-nano` return HTTP 500
 3. Tag and push: `git tag vX.Y.Z && git push origin main vX.Y.Z`.
 4. Update the version in the README's "Pinning a version" example.
 
-CI is defined in `.gitea/workflows/ci.yml` and runs once Gitea Actions are
-enabled for the repository.
+## CI
+
+CI is defined in `.github/workflows/ci.yml`, which Gitea Actions reads as
+well. It runs once Actions are enabled for the repository and a runner is
+available.
+
+The workflow checks out code with `ischanx/checkout`, not
+`actions/checkout`. Upstream builds the clone URL from the server's origin
+and drops the `/git` subpath of imsc.uni-graz.at, so cloning fails
+([actions/checkout#1370](https://github.com/actions/checkout/issues/1370)).
+The fork's v6.0.2 tag fixes that; its v4 tags are identical to upstream and
+do not. The action is pinned to a commit hash because it runs with the CI
+token. When upgrading, review the fork's diff against upstream first.