chore(deps): bump actions/stale from 10 to 11 #108
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_call: | |
| permissions: | |
| contents: read | |
| jobs: | |
| ci: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Scan for secrets | |
| env: | |
| # Bump together; checksum from | |
| # https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_checksums.txt | |
| GITLEAKS_VERSION: 8.30.1 | |
| GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb | |
| run: | | |
| set -euo pipefail | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o /tmp/gitleaks.tgz | |
| echo "${GITLEAKS_SHA256} /tmp/gitleaks.tgz" | sha256sum -c - | |
| tar xz -C /tmp -f /tmp/gitleaks.tgz | |
| /tmp/gitleaks detect --source . --verbose --redact | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 22 | |
| cache: 'npm' | |
| - name: Check for large files | |
| run: | | |
| LARGE=$(find . -not -path './.git/*' -not -path './node_modules/*' -type f -size +5M) | |
| if [ -n "$LARGE" ]; then | |
| echo "::error::Large files detected (>5 MB):" | |
| echo "$LARGE" | |
| exit 1 | |
| fi | |
| - name: Install dependencies | |
| run: npm ci --ignore-scripts | |
| - name: Audit high-severity vulnerabilities | |
| run: npm audit --audit-level=high | |
| # `eslint --cache` writes to .eslintcache at cwd; persist it across | |
| # runs so warm CI lints incrementally instead of rescanning the tree. | |
| - name: Restore ESLint cache | |
| uses: actions/cache@v5 | |
| with: | |
| path: .eslintcache | |
| key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.js', 'package-lock.json') }}-${{ hashFiles('src/**/*.js', 'functions/**/*.js', 'tests/**/*.js') }} | |
| restore-keys: | | |
| eslint-${{ runner.os }}-${{ hashFiles('eslint.config.js', 'package-lock.json') }}- | |
| eslint-${{ runner.os }}- | |
| - name: Lint | |
| run: npm run lint | |
| - name: Test | |
| run: npm test | |
| - name: Build contract | |
| run: npm run build |