Skip to content
CI

docs: record the audit's SSRF-02 acceptance at the call site #27

Sign in to view logs

docs: record the audit's SSRF-02 acceptance at the call site

docs: record the audit's SSRF-02 acceptance at the call site #27

Workflow file for this run

.github/workflows/ci.yml at 678678c
name: CI
on:
push:
branches: ["main", "feat/**", "feature/**", "fix/**"]
pull_request:
branches: ["main"]
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: Set up Node
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
# 22, not 20: `npm test` runs `node --test` directly against .ts sources, which
# needs Node's built-in type stripping (unflagged from 22.18). On Node 20 every
# test fails with ERR_UNKNOWN_FILE_EXTENSION. The plugin's *runtime* requirement
# is still Node 20+ — dist/ is bundled plain JS.
node-version: "22"
cache: npm
- name: Install dependencies
run: npm ci
# `npm run build` runs `tsc --noEmit` before bundling, so this is the
# typecheck gate as well as the build.
- name: Build (typecheck + bundle)
run: npm run build
- name: Test
run: npm test
# Its own step, deliberately, and after the unit tests. A red vocabulary means "go
# edit src/vocabulary.ts" — a different instruction from any unit failure — and
# folding the two into one command lets either hide the other. It reaches the
# network on purpose and has no skip path; see src/gates/vocabulary-parity.ts.
#
# Do NOT set TASK_QUEUE_MCP_REF here. It defaults to task-queue-mcp's `main`, which
# is the whole point: pinning it to anything else asserts parity with something
# nobody is running.
- name: Vocabulary parity with task-queue-mcp main
run: npm run gate:vocabulary
# Production dependencies only. The dev tree carries advisories that do not
# apply to a plugin bundled at build time and never served by a dev server.
- name: Audit production dependencies
run: npm audit --omit=dev --audit-level=high