build

security: harden contribution workflow governance #83

	name: build

	on:
	push:
	branches:
	- '*'
	tags:
	- '*'
	pull_request:
	branches:
	- master

	permissions:
	contents: read

	jobs:
	build:
	runs-on: ubuntu-latest
	timeout-minutes: 15
	strategy:
	matrix:
	node-version: [22.x, 24.x]
	steps:
	- name: "Checkout repository"
	uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
	with:
	persist-credentials: false
	- name: Use Node.js ${{ matrix.node-version }}
	# zizmor: ignore[cache-poisoning] package-manager caching is explicitly disabled below.
	uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
	with:
	node-version: ${{ matrix.node-version }}
	# Do not share a dependency cache between untrusted Pull Requests.
	cache: ''
	- name: Npm install
	run: npm ci
	- name: Npm build
	run: npm run build --if-present
	- name: Verify generated bundle is committed
	# GitHub Actions executes dist/index.js from the consumer's pinned
	# commit. Reject a hand-edited or stale bundle before tests can pass.
	run: \|
	git diff --exit-code -- dist/
	test -f dist/index.js
	git ls-files --error-unmatch dist/index.js >/dev/null
	test -z "$(git ls-files --others --exclude-standard -- dist/)"
	- name: Lint (prettier + knip + publint)
	run: npm run lint
	- name: Npm test
	run: npm test

Navigation Menu