mirror of
https://github.com/teamchong/pxpipe.git
synced 2026-07-22 02:02:51 +02:00
Danil Silantyev
c399abd63c
The workflow only checks out, builds, and tests — it never writes to the repo, so scope GITHUB_TOKEN down to contents: read (GitHub's recommended least privilege; the default token grant is broader than this job needs). Also add a per-ref concurrency group so a new push to a PR cancels its superseded run. No job/step logic changed; Node stays on 22 (current LTS).
32 lines
740 B
YAML
32 lines
740 B
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
# Least privilege: CI only reads the checkout; it never writes to the repo,
|
|
# creates releases, or comments. Override per-job if a future job needs more.
|
|
permissions:
|
|
contents: read
|
|
|
|
# Cancel superseded runs on the same ref (e.g. a force-push to a PR branch).
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: pnpm/action-setup@v6
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
- run: pnpm install --frozen-lockfile
|
|
- run: pnpm run typecheck
|
|
- run: pnpm test
|
|
- run: pnpm run build
|