ci: restore SHA-pinned OpenSSF Scorecard workflow #55

	name: CI

	"on":
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read
	actions: read

	jobs:
	test:
	runs-on: ubuntu-latest

	strategy:
	matrix:
	node-version: [18, 20, 22]

	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

	- name: Setup Node.js ${{ matrix.node-version }}
	uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
	with:
	node-version: ${{ matrix.node-version }}
	cache: 'npm'

	- name: Install dependencies
	run: npm ci

	- name: Type check
	run: npx tsc --noEmit

	- name: Build
	run: npm run build

	- name: Test - Core (79 tests)
	run: npx ts-node test-standalone.ts

	- name: Test - Security (33 tests)
	run: npx ts-node test-security.ts

	- name: Test - Adapters (139 tests)
	run: npx ts-node test-adapters.ts

	build:
	runs-on: ubuntu-latest
	needs: test

	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

	- name: Setup Node.js
	uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
	with:
	node-version: 20
	cache: 'npm'

	- name: Install dependencies
	run: npm ci

	- name: Build
	run: npm run build

	- name: Verify dist output
	run: \|
	test -f dist/index.js \|\| (echo "dist/index.js missing" && exit 1)
	test -f dist/index.d.ts \|\| (echo "dist/index.d.ts missing" && exit 1)
	test -f dist/security.js \|\| (echo "dist/security.js missing" && exit 1)
	test -d dist/adapters \|\| (echo "dist/adapters missing" && exit 1)
	test -d dist/lib \|\| (echo "dist/lib missing" && exit 1)
	echo "Build verification passed"

Provide feedback