ci(mono-pub): run publish job from LTS node #39

	name: Mono-pub CI

	on:
	push:
	branches: [ "main" ]
	pull_request:
	branches: [ "main" ]

	jobs:
	lint:
	name: Lint code

	runs-on: ubuntu-22.04

	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Setup Node.js environment
	uses: actions/setup-node@v4
	with:
	cache: 'yarn'

	- name: Install dependencies
	run: yarn --immutable

	- name: Lint source code
	run: yarn lint

	audit:
	name: Audit dependencies

	runs-on: ubuntu-22.04

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Node.js environment
	uses: actions/setup-node@v4
	with:
	cache: 'yarn'

	- name: Install dependencies
	run: yarn --immutable

	- name: Run dependencies audit
	run: yarn npm audit --all

	semgrep:
	name: Audit source code

	runs-on: ubuntu-22.04

	container:
	image: semgrep/semgrep

	if: (github.actor != 'dependabot[bot]')

	permissions:
	security-events: write

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Run semgrep scan
	run: ./bin/run-semgrep.sh

	build:
	name: Build and Test packages

	runs-on: ubuntu-22.04

	strategy:
	matrix:
	node-version: [ 18.x, 20.x, 22.x ]
	# See supported Node.js release schedule at https://nodejs.org/en/about/releases

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Node.js environment
	uses: actions/setup-node@v4
	with:
	node-version: ${{ matrix.node-version }}
	cache: 'yarn'

	- name: Install dependencies
	run: yarn --immutable

	- name: Build repo
	run: yarn build

	- name: Run tests
	run: yarn test

Provide feedback