This repository was archived by the owner on Jun 23, 2026. It is now read-only.

ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 #32

	# template note:
	# action references in this file ship as semver tags so the template builds on day one.
	# after `scripts/init.sh`, run `npm run pin-actions` (or it runs automatically) to rewrite
	# every `uses:` line to a full commit sha. dependabot bumps the sha; the trailing
	# `# v6.x` comment is preserved for human readability.

	name: ci

	on:
	pull_request:
	branches: [main]
	push:
	branches: [main]
	workflow_dispatch:

	permissions:
	contents: read

	concurrency:
	group: ci-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	ci:
	name: lint / typecheck / test / audit / build
	runs-on: ubuntu-latest
	steps:
	- name: harden runner
	uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
	with:
	egress-policy: audit

	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	persist-credentials: false

	- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
	with:
	node-version: 24
	cache: npm

	- name: install (locked, no scripts)
	run: npm ci --ignore-scripts

	- name: lint
	run: npm run lint

	- name: typecheck
	run: npm run typecheck

	- name: test
	run: npm run test

	- name: audit
	run: npm run audit

	- name: build
	run: npm run build

	pinned-actions:
	name: every action is sha-pinned
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	persist-credentials: false

	- name: assert no tag references in workflows
	run: bash scripts/check-pins.sh

Navigation Menu