chore(wheelhouse): cascade template@45e9fdc2 #2455

	name: ⚡ CI

	# Dependencies:
	# - SocketDev/socket-registry/.github/workflows/ci.yml

	on:
	push:
	branches: [main]
	tags: ['*']
	pull_request:
	branches: [main]
	workflow_dispatch:

	permissions:
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	ci:
	name: Run CI Pipeline
	uses: SocketDev/socket-registry/.github/workflows/ci.yml@74f3353793b9a9619bef7badae29821260bd4225 # main (2026-05-28)
	with:
	test-script: 'pnpm run build && pnpm exec vitest --config .config/repo/vitest.config.mts run'
	# Pass the Socket API token so the install step runs sfw-enterprise,
	# which honors the org security policy (where package-alert allowlist
	# entries live). Without it, install falls back to sfw-free, which has
	# no policy and fails on AI-scan flags like the @redwoodjs/agent-ci FP.
	secrets:
	SOCKET_API_TOKEN: ${{ secrets.SOCKET_API_TOKEN }}

	test-isolated:
	name: Test (Isolated)
	needs: ci
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: SocketDev/socket-registry/.github/actions/setup-and-install@c4b120c34fa95a9974ffb3f407fa58f4d167c844 # main (2026-06-02)
	with:
	socket-api-token: ${{ secrets.SOCKET_API_TOKEN }}
	- name: Build project
	run: pnpm run build

	- name: Run isolated tests
	run: pnpm exec vitest --config .config/repo/vitest.config.isolated.mts run

Provide feedback