Merge pull request #12 from rivet-dev/ralph/kernel-hardening #69

	name: CI

	on:
	push:
	branches:
	- main
	pull_request:
	branches:
	- main

	jobs:
	typecheck-and-test:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	# --- Rust / WASM build ---
	- name: Set up Rust toolchain
	uses: dtolnay/rust-toolchain@nightly
	with:
	toolchain: nightly-2026-03-01
	targets: wasm32-wasip1
	components: rust-src

	- name: Install wasm-opt (binaryen)
	run: sudo apt-get update && sudo apt-get install -y binaryen

	- name: Cache WASM build artifacts
	uses: actions/cache@v4
	with:
	path: \|
	wasmvm/target
	wasmvm/vendor
	key: wasm-${{ runner.os }}-${{ hashFiles('wasmvm/Cargo.lock', 'wasmvm/rust-toolchain.toml') }}

	- name: Build WASM binary
	run: cd wasmvm && make wasm

	# --- Node.js / TypeScript ---
	- name: Set up pnpm
	uses: pnpm/action-setup@v4
	with:
	version: 8.15.6

	- name: Set up Node.js
	uses: actions/setup-node@v4
	with:
	node-version: 22
	cache: pnpm
	cache-dependency-path: pnpm-lock.yaml

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	- name: Type check
	run: pnpm check-types

	- name: Run tests
	run: pnpm test

Provide feedback