Consolidate the test suite into a single unit runner #21

	name: CI

	on:
	pull_request:
	push:
	branches: [main]

	# Least privilege: this workflow only reads the checkout. Without an explicit
	# block the job would inherit the repository default, which can be write.
	permissions:
	contents: read

	concurrency:
	group: ci-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	verify:
	name: Verify
	runs-on: ubuntu-latest
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Set up Node
	uses: actions/setup-node@v4
	with:
	node-version-file: package.json
	cache: npm

	- name: Install dependencies
	run: npm ci

	- name: Lint
	run: npm run biome

	- name: Typecheck
	run: npm run typecheck

	# Fails when component schemas changed without regenerating the committed
	# manifest. Also rejects duplicate component types and invalid schemas,
	# which the generator refuses to serialize.
	- name: Check component manifest
	run: npm run weaverse:manifest:check

	# Flags settings that look like credentials but were never classified.
	# `sensitive: true` is the real boundary; this catches what humans missed.
	- name: Audit Weaverse settings
	run: npm run weaverse:audit

	# Typecheck does not see bundler-level breakage: a bad dynamic import, a
	# client-only module pulled into the worker bundle, or a Vite plugin
	# misconfiguration all typecheck clean and fail at deploy. The build
	# needs no storefront credentials, so it runs unauthenticated here.
	- name: Build
	run: npm run build

Navigation Menu