Enforce dangerous patterns and harden bash exec #588

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	jobs:
	test:
	name: Test (${{ matrix.os }})
	runs-on: ${{ matrix.os }}
	# macOS is flaky due to slow CI runners - don't block PRs
	continue-on-error: ${{ matrix.os == 'macos-latest' }}
	strategy:
	fail-fast: false
	matrix:
	# Windows disabled pending fixes - see GitHub issue #134
	os: [ubuntu-latest, macos-latest]

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup pnpm
	uses: pnpm/action-setup@v4
	with:
	version: 9

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: '22'

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	- name: Build
	run: pnpm build

	- name: Run tests
	run: pnpm test

	# Coverage only on Ubuntu (faster, same code)
	- name: Run tests with coverage
	if: matrix.os == 'ubuntu-latest'
	run: pnpm test:coverage

	- name: Upload coverage reports
	if: matrix.os == 'ubuntu-latest'
	uses: codecov/codecov-action@v4
	with:
	files: ./coverage/lcov.info
	fail_ci_if_error: false
	env:
	CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

	lint:
	name: Type Check
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup pnpm
	uses: pnpm/action-setup@v4
	with:
	version: 9

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: '22'

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	- name: Type check
	run: pnpm build

Navigation Menu