build

security: add strict v3 CLA workflow #100

	name: build

	on:
	push:
	branches:
	- '*'
	tags:
	- '*'
	pull_request:
	branches:
	- master

	permissions:
	contents: read

	jobs:
	build:
	runs-on: ubuntu-24.04
	timeout-minutes: 15
	strategy:
	matrix:
	node-version: [22.x, 24.x]
	steps:
	- name: "Checkout repository"
	uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
	with:
	persist-credentials: false
	- name: Use Node.js ${{ matrix.node-version }}
	uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
	with:
	node-version: ${{ matrix.node-version }}
	- name: Npm install
	run: npm ci
	- name: Npm build
	run: npm run build --if-present
	- name: Verify generated bundle is committed
	# GitHub Actions executes dist/index.js from the consumer's pinned
	# commit. Reject a hand-edited or stale bundle before tests can pass.
	run: \|
	git diff --exit-code -- dist/
	test -f dist/index.js
	git ls-files --error-unmatch dist/index.js >/dev/null
	test -z "$(git ls-files --others --exclude-standard -- dist/)"
	- name: Lint (prettier + knip + publint)
	run: npm run lint
	- name: Npm test
	run: npm test

	cla-rerun-binding:
	name: CLA rerun binding fixtures
	runs-on: ubuntu-24.04
	timeout-minutes: 10
	permissions:
	contents: read
	steps:
	- name: Checkout repository
	uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
	with:
	persist-credentials: false
	- name: Run CLA rerun binding fixtures
	run: tests/test_cla_rerun_binding.sh

Navigation Menu