Merge branch 'main' into sirtimid/refactor-kernel-store

Author: sirtimid

.github/workflows/lint-build-test.yml

@@ -149,7 +149,7 @@ jobs:
           yarn build-release
           cd -
       - run: yarn build
-      - run: yarn run test
+      - run: yarn test:ci
       - name: Require clean working directory
         shell: bash
         run: |

.github/workflows/security-code-scanner.yml

@@ -0,0 +1,38 @@
+name: MetaMask Security Code Scanner
+
+on:
+  push:
+    branches: ['main']
+  pull_request:
+    branches: ['main']
+  workflow_call:
+    secrets:
+      SECURITY_SCAN_METRICS_TOKEN:
+        required: false
+      APPSEC_BOT_SLACK_WEBHOOK:
+        required: false
+  workflow_dispatch:
+
+jobs:
+  run-security-scan:
+    name: Run security scan
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Analyze code
+        uses: MetaMask/action-security-code-scanner@v1
+        with:
+          repo: ${{ github.repository }}
+          paths_ignored: |
+            '**/*.test.js*'
+            '**/*.test.ts*'
+            '**/docs/'
+            '**/playwright.config.ts'
+            '**/test/'
+            '**/vitest.config*.ts'
+            node_modules
+          project_metrics_token: ${{ secrets.SECURITY_SCAN_METRICS_TOKEN }}
+          slack_webhook: ${{ secrets.APPSEC_BOT_SLACK_WEBHOOK }}

package.json

@@ -31,13 +31,12 @@
     "postinstall": "simple-git-hooks",
     "prepack": "./scripts/prepack.sh",
     "pretest": "bash scripts/reset-coverage-thresholds.sh",
-    "posttest": "printf '\\n' >> vitest.config.ts",
-    "test": "yarn pretest && vitest run && yarn posttest",
-    "test:dev": "yarn pretest && vitest run --mode development && yarn posttest",
-    "test:clean": "yarn test --no-cache --coverage.clean",
+    "test": "yarn pretest && vitest run",
+    "test:ci": "vitest run",
+    "test:dev": "yarn test --mode development",
     "test:e2e": "yarn workspaces foreach --all run test:e2e",
     "test:e2e:ci": "yarn workspaces foreach --all run test:e2e:ci",
-    "test:verbose": "yarn pretest && yarn test --reporter verbose && yarn posttest",
+    "test:verbose": "yarn test --reporter verbose",
     "test:watch": "vitest",
     "why:batch": "./scripts/why-batch.sh"
   },