ci.yml

name: CI

on:
  push:
    branches: [master, develop]
  pull_request:

# Least privilege by default; no job here needs to write anything.
permissions: {}

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      # Actions are pinned to commit SHAs, not tags: a tag can be moved to
      # point at new code, so a tag reference is a supply chain hole.
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # Do not leave the job token in .git/config for later steps to reach.
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: "1.3.14"

      # --frozen-lockfile: a dependency change cannot land without the lockfile
      # that reproduces it. --ignore-scripts: no dependency lifecycle script
      # runs in CI, which is the usual path for a compromised package to
      # execute code. Verified that nothing here needs them.
      - name: Install
        run: bun install --frozen-lockfile --ignore-scripts

      - name: Typecheck
        run: bun run typecheck

      - name: Lint
        run: bun run lint

      - name: Test
        run: bun test

      # The published tarball is TypeScript source with no build step, so
      # nothing else would catch a files/exports mistake before a release.
      - name: Check package contents
        run: npm pack --dry-run