.github/dependabot.yml

-Original file line number
+Diff line change
@@ -0,0 +1,16 @@
+    version: 2
+    updates:
+      # Keep updates focused on the spec-aligned pnpm workspace. The legacy
+      # `tokenhost-web-template/` directory is intentionally not included.
+      - package-ecosystem: "npm"
+        directory: "/"
+        schedule:
+          interval: "weekly"
+        open-pull-requests-limit: 5
+      - package-ecosystem: "github-actions"
+        directory: "/"
+        schedule:
+          interval: "weekly"
+        open-pull-requests-limit: 5

.github/workflows/ci.yml

-Original file line number
+Diff line change
@@ -0,0 +1,50 @@
+    name: CI
+    on:
+      pull_request:
+      push:
+        branches:
+          - master
+    jobs:
+      test:
+        runs-on: ubuntu-latest
+        timeout-minutes: 20
+        steps:
+          - name: Checkout
+            uses: actions/checkout@v4
+          - name: Setup Node
+            uses: actions/setup-node@v4
+            with:
+              node-version: "20"
+          - name: Setup pnpm
+            uses: pnpm/action-setup@v4
+            with:
+              version: "10.12.1"
+          - name: Get pnpm store dir
+            id: pnpm-store
+            run: echo "store_path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+          - name: Cache pnpm store
+            uses: actions/cache@v4
+            with:
+              path: ${{ steps.pnpm-store.outputs.store_path }}
+              key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+              restore-keys: |
+                pnpm-store-${{ runner.os }}-
+          - name: Install
+            run: pnpm install --frozen-lockfile
+          - name: Test
+            run: pnpm test
+          - name: Typecheck
+            run: pnpm typecheck
+          - name: Audit (non-blocking)
+            continue-on-error: true
+            run: pnpm audit --audit-level high

CI: Node 20 + pnpm test; isolate legacy template from workspace #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

snissn merged 4 commits into master from feat/ci-security

Feb 5, 2026

-Original file line number
+Diff line change
@@ -0,0 +1,16 @@
+    version: 2
+    updates:
+      # Keep updates focused on the spec-aligned pnpm workspace. The legacy
+      # `tokenhost-web-template/` directory is intentionally not included.
+      - package-ecosystem: "npm"
+        directory: "/"
+        schedule:
+          interval: "weekly"
+        open-pull-requests-limit: 5
+      - package-ecosystem: "github-actions"
+        directory: "/"
+        schedule:
+          interval: "weekly"
+        open-pull-requests-limit: 5

-Original file line number
+Diff line change
@@ -0,0 +1,50 @@
+    name: CI
+    on:
+      pull_request:
+      push:
+        branches:
+          - master
+    jobs:
+      test:
+        runs-on: ubuntu-latest
+        timeout-minutes: 20
+        steps:
+          - name: Checkout
+            uses: actions/checkout@v4
+          - name: Setup Node
+            uses: actions/setup-node@v4
+            with:
+              node-version: "20"
+          - name: Setup pnpm
+            uses: pnpm/action-setup@v4
+            with:
+              version: "10.12.1"
+          - name: Get pnpm store dir
+            id: pnpm-store
+            run: echo "store_path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+          - name: Cache pnpm store
+            uses: actions/cache@v4
+            with:
+              path: ${{ steps.pnpm-store.outputs.store_path }}
+              key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+              restore-keys: |
+                pnpm-store-${{ runner.os }}-
+          - name: Install
+            run: pnpm install --frozen-lockfile
+          - name: Test
+            run: pnpm test
+          - name: Typecheck
+            run: pnpm typecheck
+          - name: Audit (non-blocking)
+            continue-on-error: true
+            run: pnpm audit --audit-level high

Provide feedback