ci: publish with a 2FA-bypass token and attach provenance #3

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	workflow_dispatch:

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	check:
	name: ${{ matrix.os }} · node ${{ matrix.node }}
	runs-on: ${{ matrix.os }}
	strategy:
	fail-fast: false
	matrix:
	# Windows and macOS are both first-class targets, and the path,
	# line-ending and process-signal behaviour genuinely differs between
	# them — so both are tested rather than assumed.
	os: [ubuntu-latest, windows-latest, macos-latest]
	# Node 22 is the oldest release with a built-in SQLite driver, so the
	# session tests only have full coverage from there upwards.
	node: [20, 22, 24]

	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-node@v4
	with:
	node-version: ${{ matrix.node }}
	cache: npm

	- name: Configure git identity
	run: \|
	git config --global user.name "CI"
	git config --global user.email "ci@example.com"
	git config --global init.defaultBranch main

	- run: npm ci

	- run: npm run lint

	- run: npm run typecheck

	- run: npm test

	- run: npm run build

	package:
	name: package contents
	runs-on: ubuntu-latest
	needs: check
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version: 22
	cache: npm
	- run: npm ci
	- run: npm run build
	- name: Verify the published tarball
	run: \|
	npm pack --dry-run
	# The plugin and CLI entry points must both survive packing.
	test -f dist/plugin/index.js
	test -f dist/cli/index.js
	test -f dist/core/index.js

Navigation Menu