Merge pull request #2 from ushironoko/npm-publish-supplychain #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| # Cancel superseded runs on the same ref (e.g. rapid PR pushes). | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| verify: | |
| name: lint · typecheck · test · build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| # bun-version is read from package.json "packageManager" (bun@1.3.13) automatically. | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| # --ignore-scripts blocks dependency lifecycle scripts (the preinstall/postinstall | |
| # vector used by Shai-Hulud-class worms). Safe here: the native deps ship prebuilt | |
| # binaries via os/cpu-constrained optionalDependencies with no lifecycle scripts. | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile --ignore-scripts | |
| # Fail if install mutated the lockfile (frozen install already forbids it; this | |
| # makes a tampered/desynced bun.lock an explicit, visible failure). | |
| - name: Verify lockfile is unchanged | |
| run: git diff --exit-code bun.lock | |
| - name: Lint (biome) | |
| run: bun run lint | |
| # Type lane: type-checks all sources, the *.test.ts files, and the *.test-d.ts | |
| # type-level assertions (expect-type / @ts-expect-error) via tsgo | |
| # (@typescript/native-preview). Resolves on linux-x64 under --ignore-scripts | |
| # because the platform binary ships as an os/cpu-constrained optionalDependency. | |
| - name: Typecheck | |
| run: bun run test:type | |
| - name: Build (rolldown) | |
| run: bun run build | |
| # Runs unit + the real-tsgo integration tests; coverage is reported (text + lcov), | |
| # not gated on a threshold. | |
| - name: Test with coverage | |
| run: bun run test:coverage | |
| - name: Upload coverage (lcov) | |
| if: ${{ always() }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: coverage-lcov | |
| path: coverage/lcov.info | |
| if-no-files-found: warn | |
| retention-days: 14 |