ci.yml

name: CI
on: [push, pull_request]
env:
  NODE_VERSION: 18.2
  PNPM_VERSION: 7.28.0
jobs:
  gitleaks:
    name: 🔒 Run Git leaks
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}
      - uses: pnpm/action-setup@v2
        with:
          version: ${{ env.PNPM_VERSION }}
      # Skip post-install scripts here, as a malicious
      # script could steal NODE_AUTH_TOKEN.
      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts
        env:
          CI: true
          NODE_AUTH_TOKEN: ${{ secrets.CI_NPM_READ_ORG }}
      - name: Gitleaks
        run: npm run leaks
        shell: bash
  pr:
    name: 👷 Build / Lint / Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}
      - uses: pnpm/action-setup@v2
        with:
          version: ${{ env.PNPM_VERSION }}
      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts
        env:
          CI: true
          NODE_AUTH_TOKEN: ${{ secrets.CI_NPM_READ_ORG }}

      - name: Build
        run: pnpm run build
        env:
          NODE_AUTH_TOKEN: ${{ secrets.CI_NPM_READ_ORG }}
      - name: Lint
        run: pnpm run lint
      - name: Test
        run: pnpm run test