[feat] add ci workflow, scorecards

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @edisonz0718 @AndyBoWu

.github/workflows/ci.yml

@@ -0,0 +1,55 @@
+name: CI Workflow for API Integration Testing
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  # Add  timestamp
+  print_timestamp:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate timestamp
+        run: |
+          echo "TIMESTAMP=$(TZ='America/Los_Angeles' date +'%Y-%m-%d %H:%M:%S')" >> $GITHUB_ENV
+
+      - name: Print timestamp
+        run: |
+          echo "Execution time (Pacific Time Zone) $TIMESTAMP"
+
+  test-and-publish:
+    needs: print_timestamp
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install pnpm
+        run: npm install -g pnpm
+
+      - name: Install Dependencies
+        run: pnpm install
+
+      - name: Lint
+        run: pnpm eslint .
+        # Ensure you have a lint script in your package.json
+
+      - name: Run Tests
+        run: pnpm exec playwright test
+        # Ensure you have a test:integration script in your package.json for your API integration tests
+
+      - name: Upload Test Results
+        uses: actions/upload-artifact@v2
+        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
+        with:
+          name: test-results
+          path: ./playwright-report/index.html

.github/workflows/scorecards.yml

@@ -0,0 +1,44 @@
+name: Scorecards supply-chain security
+on:
+  workflow_dispatch:
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecards analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      id-token: write
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+        with:
+          persist-credentials: false
+
+      # This is a pre-submit / pre-release.
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@main
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
+        with:
+          sarif_file: results.sarif

ci.env

@@ -1,3 +1,3 @@
-API_BASE_URL = "https://edge.stg.storyprotocol.net"
-API_KEY = "U3RvcnlQcm90b2NvbFRlc3RBUElLRVk="
-API_PREFIX = "/api/sepolia/v1"
+API_BASE_URL="https://edge.stg.storyprotocol.net"
+API_KEY="U3RvcnlQcm90b2NvbFRlc3RBUElLRVk="
+API_PREFIX="/api/sepolia/v1"