feat(webhook): enforce per-runner dynamic labels policy in dispatcher #2150

	name: Build lambdas

	on:
	pull_request:
	branches:
	- main
	paths:
	- 'lambdas/**'
	- '.github/workflows/lambda.yml'

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	build:
	name: Build and test lambda functions
	runs-on: ubuntu-latest
	container:
	image: node:24@sha256:aa648b387728c25f81ff811799bbf8de39df66d7e2d9b3ab55cc6300cb9175d9
	defaults:
	run:
	working-directory: ./lambdas

	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
	with:
	egress-policy: audit

	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
	with:
	persist-credentials: false
	- name: Install dependencies
	run: yarn install --frozen-lockfile
	- name: Run prettier
	run: yarn format-check
	- name: Run linter
	run: yarn lint
	- name: Run tests
	id: test
	run: yarn test
	- name: Build distribution
	run: yarn build
	- name: Upload coverage report
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	if: ${{ failure() }}
	with:
	name: coverage-reports
	path: ./**/coverage
	retention-days: 5

Provide feedback