mirror of
https://github.com/hanzoai/node-jsonwebtoken.git
synced 2026-09-24 17:00:48 +00:00
zeekayandHanzo Dev
9176fe8b5b
github.com has no runner for hanzo-build-linux-amd64, so a caller under .github/workflows is a gate that can never be scheduled. This is the ~7-line caller on the plane that can (git.hanzo.ai git-runner fleet), pinned @v1. Co-authored-by: Hanzo Dev <[email protected]>
18 lines
862 B
YAML
18 lines
862 B
YAML
# Canonical CI/CD config for hanzoai/node-jsonwebtoken — read by the hanzoai/ci
|
|
# reusable workflow (.hanzo/workflows/cicd.yml) and by platform.hanzo.ai.
|
|
#
|
|
# LIBRARY: JWT sign/verify/decode. No image, no deploy — it ships from a tag.
|
|
#
|
|
# The gate is the mocha suite, and for this package it is not optional. Every
|
|
# CVE this library has ever had was a *verification* bug that compiled
|
|
# perfectly: `alg: none` accepted, an RS256 public key accepted as an HS256
|
|
# shared secret, `algorithms` not enforced, an expired token let through
|
|
# because clockTolerance was applied on the wrong side. test/ asserts each of
|
|
# those refusals by name. A build or type gate is worth nothing here — the
|
|
# whole product is which tokens it rejects.
|
|
#
|
|
# `npm install`, not `npm ci`: this repo ships no package-lock.json.
|
|
test:
|
|
- name: test
|
|
run: npm install && npm test
|