audit-labs/gh-attest

 1name: CI
 2
 3on:
 4  pull_request:
 5  push:
 6    branches: [main]
 7
 8permissions:
 9  contents: read
10
11jobs:
12  # Only the mapping check lives here. Cloudflare Workers Builds already runs
13  # `wrangler types && tsc --noEmit` as its build command, on every branch, so
14  # duplicating the typecheck bought a second copy of the same signal.
15  #
16  # What Workers Builds does not do is compare the control mappings against the
17  # docs — and that check needs no Cloudflare credentials, which is why it can
18  # live here and the migration guard cannot.
19  mappings:
20    runs-on: ubuntu-latest
21    steps:
22      - uses: actions/checkout@v7
23
24      - uses: actions/setup-node@v7
25        with:
26          node-version: '26'
27
28      # No install step: check-mappings.mjs has no dependencies. It applies the
29      # migrations to an in-memory SQLite database using Node's built-in module
30      # and diffs the resulting control_mappings against
31      # docs/framework-mapping.md, rationale text included.
32      - name: Control mappings match the docs
33        run: node scripts/check-mappings.mjs