Security regression workflow

Run the fixture tests on pushes and pull requests. Read-only permissions; no deployment.

Where it goes

Save as .github/workflows/security.yml in the extracted kit repository.

How to use this resource

Keep the fixed app.mjs and security.test.mjs at your lab repository root.
Create .github/workflows and save security.yml inside it.
Commit and push to your own lab repository to run GitHub Actions.
Open Actions → Security regression tests → security-tests. Expect five passing tests.

Hosted CI is optional. Uploading these exercise files does not publish the website. Lab 04 also provides a fully local regression exercise.

security.yml

# Learning template: save at .github/workflows/security.yml in the kit repository.
# Version tags are readable teaching defaults. Review and pin action commit SHAs
# before adopting this in production. This workflow does not deploy anything.
name: Security regression tests
on:
  push:
  pull_request:
permissions:
  contents: read
jobs:
  security-tests:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: '24'
          package-manager-cache: false
      - name: Verify authorization and HTTP behavior
        run: node --test security.test.mjs