diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 8640359..1c8b057 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -13,5 +13,3 @@ # Operational scripts /scripts/safe-update.ts @metanallok -/scripts/backfill.ts @metanallok -/scripts/backfillV06.ts @metanallok diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..431ef39 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,38 @@ +name: CI + +on: + pull_request: + push: + branches: [master] + +permissions: + contents: read + +jobs: + test: + runs-on: ubuntu-latest + env: + # Never let CI touch the production alert relay or a real RPC. + ALERT_WEBHOOK_URL: "" + NODE_ENV: test + + steps: + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 + with: + bun-version: 1.3.14 + + # bunfig.toml registers the Socket security scanner, so this install also + # scans all direct + transitive deps and fails on malicious packages. + - name: Install dependencies (frozen lockfile + Socket scan) + run: bun install --frozen-lockfile + + - name: Typecheck + run: bun run typecheck + + - name: Test + run: bun test + + - name: Phantom dependency check + run: bun run deps:check diff --git a/AGENTS.md b/AGENTS.md index 13f346c..7a8be25 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -12,23 +12,25 @@ - **`bun test`** - Run all tests - **`bun run