Repository navigation

Harden pnpm installs against compromised releases #74

	name: CI

	on:
	pull_request:
	branches: [main]
	push:
	branches: [main]

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	# Installs, also nested ones in scripts, skip dependency scripts and pnpmfiles.
	env:
	pnpm_config_ignore_scripts: "true"
	pnpm_config_ignore_pnpmfile: "true"

	jobs:
	validate:
	name: Validate
	runs-on: ubuntu-latest

	steps:
	- name: Checkout
	uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
	with:
	fetch-depth: 0
	# Nothing here pushes; keep the token out of .git/config.
	persist-credentials: false

	- name: Setup PNPM
	# v6.1.0 is the first release that installs pnpm 12; the v6 tag still points to 6.0.10.
	uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0

	- name: Setup Node
	uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
	with:
	node-version-file: .nvmrc
	cache: pnpm

	- name: Install dependencies
	run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile

	- name: Check changeset
	if: github.event_name == 'pull_request' && !startsWith(github.head_ref, 'changeset-release/')
	run: pnpm exec changeset status --since=origin/${{ github.event.pull_request.base.ref }}

	- name: Check code
	run: pnpm check