chore: static analysis audit #3

	name: Analysis

	# permissions:
	# contents: read

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	types: [opened, synchronize, reopened]

	jobs:
	analysis:
	timeout-minutes: 10
	runs-on: ubuntu-latest
	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
	with:
	disable-sudo-and-containers: true
	egress-policy: audit
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version: lts/*
	- name: Install dependencies
	run: npm ci
	# TODO: Move to the trunk action once Eslint@9 is supported
	- name: Run Trunk check
	run: \|
	curl -fsSLO --retry 3 https://trunk.io/releases/trunk
	chmod +x trunk
	./trunk check --ci
	# TODO: Integrate with Trunk once Eslint@9 is supported
	# https://github.com/trunk-io/plugins/issues/962
	- name: Run ESLint
	run: npx next lint
	# NOTE: Playwright seems to not recommend caching the browsers
	- name: Install Playwright Browsers
	run: npx playwright install --with-deps
	# NOTE: Playwright will run `next build` and catch any issues
	- name: Run Playwright tests
	run: npx playwright test
	- uses: actions/upload-artifact@v4
	if: ${{ !cancelled() }}
	with:
	name: playwright-report
	path: playwright-report/
	retention-days: 30

Provide feedback