Repository navigation

fix(security): minimize cached credentials, separate config from tran… #4

	name: CI

	on:
	push:
	branches: [main]
	pull_request:

	permissions:
	contents: read

	jobs:
	build-test:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
	with:
	node-version: 24
	cache: npm

	- name: Install dependencies
	run: npm ci

	- name: Type-check
	run: npm run typecheck

	- name: Build
	run: npm run build

	- name: Verify committed dist matches the build
	run: \|
	if [ -n "$(git status --porcelain dist)" ]; then
	echo "dist/ is out of date with the TypeScript sources."
	echo "Run 'npm run build' and commit the updated dist/."
	git diff --stat dist
	exit 1
	fi

	- name: Unit tests
	run: npm test