fix(security): repoint custom-call-classifier completeness caveat off… #1113
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| name: Build & Test (Node ${{ matrix.node }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| node: ["20", "22"] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Node ${{ matrix.node }} | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ matrix.node }} | |
| cache: npm | |
| - name: Install dependencies | |
| # --legacy-peer-deps because @kamino-finance/kliquidity-sdk (a transitive | |
| # dep of @kamino-finance/klend-sdk) declares peer @solana/kit@^3.0 while | |
| # klend-sdk itself uses @solana/kit@^2.3. Nesting (kit v2 hoisted, kit v3 | |
| # under kliquidity-sdk's local node_modules) is the right resolution — | |
| # the two SDKs use independent APIs of kit. Strict resolution refuses the | |
| # nest and would force us to wait for upstream alignment. | |
| run: npm ci --legacy-peer-deps | |
| - name: Typecheck & build | |
| run: npm run build | |
| - name: Lint | |
| run: npm run lint | |
| - name: Run tests | |
| run: npm test | |
| - name: "Guard: no focused (.only) tests" | |
| # Matches it/test/describe .only in any chain position (.only, .only.each, | |
| # .concurrent.only, .only.concurrent). Line-based grep won't catch a chain | |
| # split across newlines — migrate to eslint-plugin-vitest no-only-tests if | |
| # #714 lands an ESLint config. | |
| run: | | |
| set +e | |
| matches=$(grep -rEn '\b(it|describe|test)(\.\w+)*\.only\b' test/) | |
| rc=$? | |
| set -e | |
| case "$rc" in | |
| 0) printf '%s\n' "$matches" | |
| echo "::error::Focused (.only) test(s) found in test/ — remove before merging." | |
| exit 1 ;; | |
| 1) : ;; # no match — clean | |
| *) echo "::error::.only guard: grep exited $rc (error) — failing closed." | |
| exit 1 ;; | |
| esac | |
| # Note: a `binary-smoke-test` job lived here that built the linux-x64 | |
| # pkg-bundled binary on every PR and ran scripts/smoke-test-binary.mjs | |
| # against it. It was the per-PR catch for pkg-bundle startup | |
| # regressions like issue #330 (await import() tripping | |
| # ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING inside the snapshot). Removed | |
| # as a CI cost reduction — the same smoke test still runs in | |
| # release-binaries.yml for every release artifact (linux + macOS + | |
| # Windows), so a pkg-bundle regression still gets caught before users | |
| # see it; it just lands on main first and surfaces at the next release | |
| # cut instead of at PR-review time. Restore this job if pkg-bundle | |
| # regressions start making it to release-time again. |