fix(security): bound raw post HTML at MAX_HTML_CHARS before parsing (… #3

	name: CI

	on:
	pull_request:
	push:
	branches: [main]

	# A new push to the same branch makes the in-flight run obsolete.
	concurrency:
	group: ci-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	verify:
	name: lint · test · build
	runs-on: ubuntu-latest
	timeout-minutes: 10

	steps:
	- uses: actions/checkout@v4

	# Node 24 LTS matches the Vercel production runtime. The repo pins no
	# engines field, so this workflow is the de facto version of record —
	# change both together if prod moves.
	- uses: actions/setup-node@v4
	with:
	node-version: 24
	cache: npm

	- name: Install
	run: npm ci

	# Errors fail the run; warnings don't. `eslint` exits 0 on warnings by
	# design — add `--max-warnings=0` here once the existing 3 are cleared.
	- name: Lint
	run: npm run lint

	- name: Test
	run: npm test

	# No secrets needed: src/env.ts validates ANTHROPIC_API_KEY lazily on
	# first getClient() call, not at import or build time, so a keyless
	# build is a real check rather than one that passes by accident.
	- name: Build
	run: npm run build

Navigation Menu