Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions .github/dependabot.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
# This is the dependabot configuration file that automates dependency updates
# Updates section configures how dependabot should handle dependency updates:
#
# - Monitors NPM dependencies in the root directory
# - Checks for updates weekly
# - Groups updates based on their type (dev grouped by minor/patch or prod grouped by patch)
#
# - Monitors GitHub Actions dependencies in the root directory
# - Checks for updates weekly
#
# Learn more at https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#configuration-options-for-the-dependabotyml-file
version: 2
updates:
- package-ecosystem: npm
directory: /
schedule:
interval: weekly
groups:
npm-development:
dependency-type: development
update-types:
- minor
- patch
npm-production:
dependency-type: production
update-types:
- patch
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
31 changes: 31 additions & 0 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
name: CI

on:
push:
branches: [ main ]
pull_request:
branches: [ main ]

jobs:
test:
runs-on: ubuntu-latest

strategy:
matrix:
node-version: [22.x, 24.x]

steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
Copy link

Copilot AI Jul 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using a full SHA commit hash for actions/checkout is good security practice, but this specific hash should be verified. Consider using the official v4 tag hash (e.g., actions/checkout@692973e) or reference the tagged version with hash verification.

Suggested change
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332

Copilot uses AI. Check for mistakes.

- name: Setup Node.js ${{ matrix.node-version }}
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
Copy link

Copilot AI Jul 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using a full SHA commit hash for actions/setup-node is good security practice, but this specific hash should be verified. Consider using the official v4 tag hash or reference the tagged version with hash verification.

Copilot uses AI. Check for mistakes.
with:
node-version: ${{ matrix.node-version }}
cache: 'npm'

- name: Install dependencies
run: npm ci

- name: Run tests
run: npm test