ci.yml

name: CI

# Runs on every PR, including fork PRs — which means it executes untrusted
# code. Containment: pull_request-triggered fork runs receive no secrets and
# a read-only GITHUB_TOKEN, the runner is an ephemeral hosted VM, and the
# clamps below cap what a malicious PR can do with the run itself.
#
# Deliberately NOT using the setup-repo composite: it floats bun-version to
# `latest` and installs without a lockfile guarantee, which is fine for
# trusted release builds but not for untrusted PR code.
on:
  pull_request:

concurrency:
  group: ci-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build-lint-test:
    runs-on: ubuntu-latest
    # Cap compute abuse from a malicious or runaway PR.
    timeout-minutes: 20

    steps:
      - uses: actions/checkout@v4
        with:
          # Don't leave the (read-only) token readable by build/test scripts.
          persist-credentials: false

      - uses: oven-sh/setup-bun@v2
        with:
          # Keep in sync with "packageManager" in package.json.
          bun-version: 1.3.13

      - uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Install dependencies (locked)
        # Frozen lockfile: a PR cannot shift dependency resolution without
        # the lockfile change showing up in the reviewed diff.
        run: bun install --frozen-lockfile

      - run: bun build:ci
      - run: bun lint
      - run: bun type-check:ci
      - run: bun test