Skip to content

Add community health files and CI #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mark-brannan merged 4 commits into from
Aug 27, 2026
Merged

Add community health files and CI #2

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
16cf4b6
docs(community): add code of conduct, contributing, security policy
mark-brannan Aug 26, 2026
5314266
ci: run the tests on Node 20, 22 and 24
mark-brannan Aug 26, 2026
fa51a78
docs(security): keep the policy about security
mark-brannan Aug 26, 2026
f7d8306
ci: drop the workflow token's write access and persistence
mark-brannan Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
ci: drop the workflow token's write access and persistence 
Review flagged that `npm test` runs pull-request-authored code after
checkout persists its credentials. The repository default is already
read-only, so this closes the conditional rather than an open hole -- but
the default is a setting somebody can change, and the workflow should not
depend on it.

Co-Authored-By: Claude Opus 5 <[email protected]>
  • Loading branch information
@mark-brannan @claude
mark-brannan and claude committed Aug 26, 2026
commit f7d83060254cdc37693f4f61ee812112088c2a2e
7 changes: 7 additions & 0 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,12 @@ name: test
on:
push: { branches: [main] }
pull_request:

# The tests run pull-request-authored code. Nothing here needs to write to the
# repository, and the checkout's token should not outlive the step.
permissions:
contents: read

jobs:
test:
runs-on: ubuntu-latest
Expand All @@ -10,6 +16,7 @@ jobs:
node: ['20', '22', '24']
steps:
- uses: actions/checkout@v4
with: { persist-credentials: false }
- uses: actions/setup-node@v4
with: { node-version: '${{ matrix.node }}' }
# The one dependency is `ampacity`, which is data and ships no code.
Expand Down
Loading