chore: harden CI and run build + non-fork tests on push/PR

.github/workflows/test.yml

@@ -1,9 +1,15 @@
 name: test
 
-on: workflow_dispatch
+on:
+  push:
+    branches:
+      - development
+      - master
+  pull_request:
+  workflow_dispatch:
 
-env:
-  FOUNDRY_PROFILE: ci
+permissions:
+  contents: read
 
 jobs:
   check:
@@ -13,22 +19,34 @@ jobs:
     name: Foundry project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           submodules: recursive
 
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@82dee4ba654bd2146511f85f0d013af94670c4de # v1.4.0
         with:
           version: nightly
 
       - name: Run Forge build
         run: |
           forge --version
-          forge build --sizes
+          forge build
         id: build
 
+      # Fork tests require live RPC access (and secrets), so they are excluded
+      # from automatic push/PR runs to keep CI deterministic and secret-free.
+      # A manual `workflow_dispatch` run executes the full suite, so fork tests
+      # can be exercised on demand once RPC env vars are provided.
       - name: Run Forge tests
+        env:
+          FORK_TESTS: >-
+            test/{HookTarget/HookTargetMarketStatus.t.sol,HookTarget/HookTargetStakeDelegator.t.sol,Liquidator/SBLiquidator.t.sol,OFT/OFTFeeCollectorFork.t.sol,OFT/OFTFeeCollectorGulperFork.t.sol,Swaps/MigrationHelperFork.t.sol,Swaps/Swaps1Inch.sol}
         run: |
-          forge test -vvv
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            forge test -vvv
+          else
+            forge test -vvv --no-match-path "$FORK_TESTS"
+          fi
         id: test

src/HookTarget/HookTargetMarketStatus.sol

@@ -2,7 +2,7 @@
 
 pragma solidity ^0.8.0;
 
-import {DataStreamsVerifier} from "../Chainlink/DatastreamsVerifier.sol";
+import {DataStreamsVerifier} from "../Chainlink/DataStreamsVerifier.sol";
 import {IHookTarget} from "evk/interfaces/IHookTarget.sol";
 
 /// @title HookTargetMarketStatus