Run trusted private ROM and reference CI on docker-build (#66)

.gitea/workflows/private-checks.yml

@@ -0,0 +1,52 @@
+name: Private ROM checks
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  private-rom:
+    # Never expose the ROM to pull-request code or a manually selected branch.
+    if: github.ref == 'refs/heads/main'
+    runs-on: docker-build
+    container:
+      image: node:22-bookworm
+    timeout-minutes: 40
+    env:
+      CRYSTAL_ROM_PATH: .reference/ci/crystal.gbc
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Download and verify the private ROM
+        env:
+          CRYSTAL_ROM_URL: ${{ secrets.CRYSTAL_ROM_URL }}
+        run: node scripts/fetch-private-rom.mjs
+      - run: npm ci
+      - name: Install reference build dependencies
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends build-essential bison pkg-config libpng-dev
+      - name: Build RGBDS 1.0.3
+        run: |
+          git clone --depth 1 --branch v1.0.3 https://github.com/gbdev/rgbds.git .reference/rgbds
+          test "$(git -C .reference/rgbds rev-parse HEAD)" = 307846b03ea89ee57bf75f179d5f8051175ac60d
+          make -C .reference/rgbds -j2
+          make -C .reference/rgbds install
+      - name: Build the pinned PRET reference and verify parity inputs
+        run: |
+          git init .reference/pokecrystal
+          git -C .reference/pokecrystal remote add origin https://github.com/pret/pokecrystal.git
+          git -C .reference/pokecrystal fetch --depth 1 origin 7a7881d0d62e0ddbd82dcf10e7116807487ac651
+          git -C .reference/pokecrystal checkout --detach FETCH_HEAD
+          make -C .reference/pokecrystal crystal11 -j2
+          npm run check:reference
+      - name: Unit and playthrough tests with the ROM
+        run: npm test -- --maxWorkers=2
+      - run: npx playwright install --with-deps chromium webkit
+      - name: Chromium and WebKit gameplay and reference comparisons
+        run: npm run test:e2e -- --workers=2 --trace=off
+      - name: Remove private data and browser output
+        if: always()
+        run: rm -rf .reference test-results playwright-report test-saves