James Griffin
668397104a
Disables dependency lifecycle scripts by default via .npmrc (ignore-scripts=true) so arbitrary packages cannot execute code at install time. An explicit allowlist in web/package.json opts specific packages back in, and CI/Docker/Taskfile now run allow-scripts after npm install to apply it. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
48 lines
892 B
YAML
48 lines
892 B
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: ["**"]
|
|
pull_request:
|
|
branches: ["**"]
|
|
|
|
jobs:
|
|
go:
|
|
name: Go tests & lint
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: go vet
|
|
run: go vet ./...
|
|
|
|
- name: go test
|
|
run: go test ./...
|
|
|
|
web:
|
|
name: Frontend tests & type-check
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version-file: .node-version
|
|
|
|
- name: Install dependencies
|
|
working-directory: web
|
|
run: npm install && npm exec -- allow-scripts
|
|
|
|
- name: Type check
|
|
working-directory: web
|
|
run: npx tsc --noEmit
|
|
|
|
- name: Run tests
|
|
working-directory: web
|
|
run: npm test
|