Run servers and tests in one CI step

Each run: step is a separate shell, so a server backgrounded in one step is
gone by the time a later step runs. The password-secret step also used
backslash-escaped quotes inside a YAML string, which produced invalid shell.

Author: rmdes

.github/workflows/ci.yml

@@ -10,22 +10,28 @@ jobs:
       PUBLICATION_URL: http://localhost:8080
       INDIEKIT_URL: http://localhost:3000
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: "24"
       - run: npm install
-      - name: Generate a password secret
-        run: echo "PASSWORD_SECRET=$(node -e \"require('bcrypt').hash('ci',10).then(h=>console.log(h))\")" >> "$GITHUB_ENV"
-      - name: Start Indiekit
-        run: npx indiekit serve --port 3000 &
-      - name: Start static server
+
+      # Servers and tests share one step: each `run:` is a separate shell, so a
+      # server backgrounded in an earlier step is gone by the time tests run.
+      - name: Publish, build and verify
         run: |
+          export PASSWORD_SECRET="$(node -e "require('bcrypt').hash('ci',10).then(h=>console.log(h))")"
+
+          npx indiekit serve --port 3000 &
           npm run build
           npx http-server _site -p 8080 -s &
-      - name: Wait for both
-        run: |
-          for i in $(seq 1 30); do curl -sf -o /dev/null http://localhost:3000/ && break; sleep 1; done
-          for i in $(seq 1 30); do curl -sf -o /dev/null http://localhost:8080/ && break; sleep 1; done
-      - run: npm run smoke
-      - run: npm run test:types
+
+          for _ in $(seq 1 30); do
+            curl -sf -o /dev/null "$INDIEKIT_URL/" && break; sleep 1
+          done
+          for _ in $(seq 1 30); do
+            curl -sf -o /dev/null "$PUBLICATION_URL/" && break; sleep 1
+          done
+
+          npm run smoke
+          npm run test:types