From ace0584adbc5ad032f3cbae4244cfa7bfd57d7ba Mon Sep 17 00:00:00 2001 From: Khaleel Al-Adhami Date: Wed, 13 May 2026 13:53:17 -0700 Subject: [PATCH] harden ci workflow --- .github/workflows/ci.yml | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 077f91f..24bf175 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,32 +5,41 @@ on: branches: [main] pull_request: -permissions: - contents: read +permissions: {} jobs: test: name: Sanity Test runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: - bun-version: latest + persist-credentials: false + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 + with: + bun-version: 1.3.13 - name: Install dependencies - run: bun install + run: bun install --frozen-lockfile - name: Run sanity tests run: bun test test/sanity.test.ts format: name: Format Check runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: read steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: - bun-version: latest + persist-credentials: false + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 + with: + bun-version: 1.3.13 - name: Install dependencies - run: bun install + run: bun install --frozen-lockfile - name: Check formatting run: bun run format:check