CI/CD & Security

Run WOWW builds, tests, dependency audits and deployment hardening checks.

Repository verification pipeline

npm install --no-audit --no-fund
npm audit --omit=dev --audit-level=high
npm test
npm run benchmark
npm run benchmark:v1

The repository CI matrix tests Node.js 20 and 22. The static hosting build command is:

npm run build && node dist/cli.js build

Publish the generated dist/ directory.

Security baseline

• Store secrets in provider-managed encrypted environment variables.
• Never commit .env, API tokens, private keys or production passwords.
• Use least-privilege deploy credentials and rotate exposed secrets.
• Enable secret scanning and code scanning in the Git provider.
• Review dependency updates and audit production dependencies.
• Verify effective response headers on the deployed host.

Packages, Pages and supply chain

Registries, signed artifacts, provenance attestations and hosted CI runners are external services. WOWW builds static output and generates deployment adapters; it does not provide a package registry or hosted runner service.

← Documentation home