security: pin actions to SHAs and add Dependabot to bump them #91

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	jobs:
	build-test:
	name: typecheck · test · build
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

	- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
	with:
	node-version: 20
	cache: npm

	# The @spore-host/truffle-ts dependency is a public git dependency; npm
	# normalizes its lockfile URL to git+ssh, which CI runners can't clone.
	# Rewrite git@github → https so `npm ci` fetches it over HTTPS.
	- name: Install dependencies
	run: npm ci

	- name: Typecheck
	run: npm run typecheck

	- name: Test (with coverage)
	run: npm run test:cov

	- name: Build
	run: npm run build

	- name: Upload coverage
	if: always()
	uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
	with:
	name: coverage
	path: coverage/
	if-no-files-found: ignore

Navigation Menu