ci: add GitHub Actions workflows for CI and npm publishing#2
Merged
Conversation
- CI workflow: runs typecheck, lint, and unit tests on PRs and pushes to main - Release workflow: uses changesets/action to create version PRs and publish to npm https://claude.ai/code/session_015chKuhCj4bKfv9CfDXrxi1
healthcheck package requires build:proto (buf generate → tsc) to produce gen/ directory which is gitignored. Run turbo build:proto as a separate CI step before typecheck, lint, and tests in both workflows. https://claude.ai/code/session_015chKuhCj4bKfv9CfDXrxi1
- Switch changelog generator to @changesets/changelog-github for PR/commit links and author mentions in CHANGELOG.md - After changesets publish, create a GitHub Release (vX.Y.Z tag) with changelog body extracted from @connectum/core CHANGELOG - Auto-detect pre-release versions (alpha/beta/rc) and mark accordingly https://claude.ai/code/session_015chKuhCj4bKfv9CfDXrxi1
- Add `pnpm audit --prod` step to CI and Release workflows - Add CodeQL SAST workflow (JS/TS, weekly + on push/PR) - Add Dependabot config for npm and GitHub Actions dependencies - Enable npm provenance attestation on publish (id-token: write) https://claude.ai/code/session_015chKuhCj4bKfv9CfDXrxi1
- Pin all actions to full SHA hashes (supply chain protection) - Add permissions: contents: read to CI workflow - Pin node-version to 25.2.0 (reproducible builds) - Fix pnpm audit: --audit-level=high + continue-on-error (non-blocking) - Fix shell injection: use env var for publishedPackages output - Remove unnecessary autobuild step from CodeQL (JS/TS is interpreted) - Add reviewers to dependabot configuration - Add integration tests step to CI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- CodeQL: add missing contents: read permission (checkout failed with "Repository not found") - Fix flaky retry test: remove timing assertion that depended on Date.now() precision (cockatiel's jitter can reduce delay to <20ms) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
CodeQL analyze step needs actions:read to access workflow run metadata for SARIF upload telemetry. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
v3 will be deprecated in December 2026. Pinned to v4 SHA. Note: Advanced Security must be enabled in repo settings for code scanning to work (Settings → Code security). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
GitHub's default CodeQL setup (enabled via repo settings) handles code scanning automatically. Custom workflow is redundant and conflicts with the default setup. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
intech
added a commit
that referenced
this pull request
Feb 20, 2026
Dependabot alert #2: minimatch <10.2.1 has ReDoS via repeated wildcards. Force-resolve all transitive minimatch instances to patched version via pnpm.overrides. Only affects devDependencies (c8 coverage tool). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
4 tasks
intech
added a commit
that referenced
this pull request
Feb 20, 2026
fix(deps): override minimatch >=10.2.1 to fix ReDoS (Dependabot #2)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://claude.ai/code/session_015chKuhCj4bKfv9CfDXrxi1