Hardening explicit sudo 0.5.0 (#3) #20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - "v*" | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: {} | |
| jobs: | |
| test-os-matrix: | |
| name: Test OS Matrix (${{ matrix.os }}, Node ${{ matrix.node-version }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: ubuntu-latest | |
| node-version: 24.x | |
| - os: macos-latest | |
| node-version: 24.x | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| package-manager-cache: false | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run full test suite | |
| run: npm test | |
| publish: | |
| name: Publish To npm | |
| runs-on: ubuntu-latest | |
| needs: | |
| - test-os-matrix | |
| if: ${{ startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 24.x | |
| registry-url: https://registry.npmjs.org | |
| package-manager-cache: false | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Publish with provenance | |
| run: npm publish --provenance --access public | |
| - name: Publish to JSR | |
| if: ${{ hashFiles('jsr.json') != '' }} | |
| run: npx -y jsr publish |