Ulas
91c2e0ad98
- Rate-limit SPA fallback route (missing rate limiting on fs access) - Add csrfMiddleware to all state-changing auth routes (logout, create user, change password, delete user) — previously bypassed global CSRF middleware due to router registration order - Fix incomplete vCard escaping: escape backslashes before other special characters to prevent injection via contact fields - Restrict CI GITHUB_TOKEN to contents: read (least privilege) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
35 lines
598 B
YAML
35 lines
598 B
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
test:
|
|
name: Tests (Node.js ${{ matrix.node-version }})
|
|
runs-on: ubuntu-latest
|
|
|
|
strategy:
|
|
matrix:
|
|
node-version: [22.x, 24.x]
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js ${{ matrix.node-version }}
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: ${{ matrix.node-version }}
|
|
cache: npm
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Run tests
|
|
run: npm test
|