feat: CI gate: run the existing test suite and typecheck on every PR in

[andrei-hasna]

Objective

CI gate: run the existing test suite and typecheck on every PR in search — the repo has tests but no CI workflow at all [loop-infinity-300pr]

REPO: https://github.com/hasna/search

WHAT TO CHANGE
This repo has a real test suite (22 test files at HEAD) and a test script, but there is no .github/workflows directory at all, so nothing runs on a pull request. Every PR — including the ones this pipeline opens — merges without a single automated check.

Add a single workflow at .github/workflows/ci.yml that runs on pull_request and on push to the default branch.

DONE LOOKS LIKE

• .github/workflows/ci.yml exists and runs, in one job: checkout, oven-sh/setup-bun, bun install --frozen-lockfile, bun run typecheck, bun run build, bun test.
• Pin the actions to a major version tag (for example actions/checkout@v4, oven-sh/setup-bun@v2) rather than @master.
• The workflow must actually be green on this PR. If the existing suite fails on a clean checkout, that is the finding — fix the smallest thing that makes it pass, or, if the failure is environmental (needs Postgres, needs a credential, needs a network service), scope the CI job to the subset that genuinely runs hermetically and say plainly in the PR body which suites were excluded and why. Do NOT make it green with continue-on-error, || true, or by skipping tests.
• No production source changed beyond what is needed to make the gate honest.

VERIFY

• The workflow run on this PR is green in GitHub Actions.
• bun install --frozen-lockfile && bun test reproduces the same result locally.

EVIDENCE
Checked 2026-07-29 against GitHub HEAD via the GitHub API: repos/hasna/search/actions/workflows returned total_count 0, and the recursive git tree at HEAD contains 22 test files. package.json declares test=True, build=True, typecheck=True. If CI has since been added upstream, close this task as already-done with a one-line comment rather than opening an empty PR.

PROCESS: work in a branch off the default branch, one focused change, conventional commit, open a PR. Do not bundle unrelated cleanups. If the repo has a CHANGELOG, add an entry.

Verification

• policy source: base 7d7f0c3 (immutable commit — agent-proof)
• ⚠️ GATE-INTEGRITY: agent touched verify-bearing config — REVIEW (.github/workflows/ci.yml)
• containment: env — allowlist env, non-login shell, run-scoped HOME (registry auth seeded for install)
• install: pass
• typecheck: pass
• build: FAIL
• test: pass
• doctor (ci): ok — 11 checks passed (1 advisory)

---

Run run_f3ef56d10207 · backend codewith · task 3c2dc28f-e00c-4324-a04b-0a5539e6cb9d
🏭 Generated by @hasnaxyz/factory

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #5 @ 1f7b187 — lens: correctness+security+gates, reviewer Augustus (1 of 1)

What I ran, with exit codes:

• git rev-parse HEAD -> 0, confirmed 1f7b1871e9b04bc96fcd87ca20c5be983b5d0aff.
• git status --short --branch -> 0, confirmed branch lane-pr5 with no local modifications before review.
• git log --oneline origin/main..HEAD ; git diff origin/main...HEAD --stat -> 0, showed one commit and one new file, .github/workflows/ci.yml.
• git diff origin/main...HEAD -- .github/workflows/ci.yml -> 0.
• bun install -> 0.
• bun run typecheck -> 0.
• bun run build -> 127. It failed in the dashboard build with vite: command not found.
• bun test -> 0, 237 pass / 0 fail.

What I read:

• Full PR diff for .github/workflows/ci.yml.
• Full .github/workflows/ci.yml at PR head.
• package.json scripts, including build, typecheck, and test.
• dashboard/package.json, where vite is a dashboard dev dependency.
• tsconfig.json, dashboard/tsconfig.json, and dashboard/vite.config.ts for surrounding build context.

Blocking P0/P1 findings:

• P1 correctness / required CI gate: .github/workflows/ci.yml installs only the root dependencies, then runs bun run build. The root build script changes into dashboard and runs bun run build there, but vite is only declared in dashboard/package.json. On the reviewed head after the requested root bun install, bun run build fails with vite: command not found and exit code 127. This is a currently reachable failure in the CI gate introduced by this PR.

Non-blocking follow-ups:

• None.

[andrei-hasna]

Remediation pushed for the NO_GO blocker reported against 1f7b1871e9b04bc96fcd87ca20c5be983b5d0aff.

Fixed:

• .github/workflows/ci.yml now installs dashboard dependencies with bun install --frozen-lockfile in dashboard before the root bun run build step invokes the dashboard Vite build.

New PR head:

• 017d9779335ae03da63749ff2b8840cfde9b6b8d

Verification after the fix, with exit codes:

• bun install -> 0.
• cd dashboard && bun install --frozen-lockfile -> 0.
• bun run typecheck -> 0.
• bun run build -> 0.
• bun test -> 0, 237 pass / 0 fail.
• Pre-commit staged scan: git diff --cached --check -> 0; credential-pattern scan -> 0, clean.
• Pre-push staged scan -> 0, clean.

Commit pushed:

• 017d977 ci: install dashboard dependencies before build

Disposition:

• I did not merge this PR because the required exact-head review verdict for 1f7b1871e9b04bc96fcd87ca20c5be983b5d0aff was NO_GO and the branch head changed after remediation.

[andrei-hasna]

[REVIEW] GO — #5 @ 017d977 — lens: CI-gate correctness (template rollout), reviewer Laelius (1 of 1)

Reviewed the contents, not the gate. Re-rendered at the current head; the prior verdict's sha has moved.

This is one of three near-identical "add a CI gate" PRs (contacts#13, search#5, testers#18). I reviewed them as a family, because the risk in a template applied across repos is that it references something a given repo does not have. Verified per-repo rather than assumed — at this head, hasna/search has:

• dashboard/ present, with its own package.json and a committed dashboard/bun.lock
• a committed root bun.lock
• all three invoked scripts declared: typecheck (tsc --noEmit), build, test (bun test)

So every step of this workflow has something real to run, and both bun install --frozen-lockfile invocations have a lockfile to be frozen against. This PR is the cleanest of the three — it is the workflow file and nothing else, 20 lines, no code riding along (contrast contacts#13, which carries an undisclosed change to now()).

This closes a genuine hole. In my previous batch I found repos declaring a test command that nothing in the forge ever executed — a declared gate no one runs is not a gate. This is the fix for that class.

Non-blocking follow-ups (named, not gated)

1. P2 — actions pinned to floating major tags (actions/checkout@v4, oven-sh/setup-bun@v2) rather than commit SHAs. Low stakes here (no id-token: write, no deploy authority), but worth converging across the three-repo family at once.
2. P3 — no explicit permissions: block. permissions: contents: read documents intent instead of inheriting whatever the repo default happens to be, and costs one line.
3. P3 — the two install steps are visually confusable. They differ only by working-directory: dashboard on the second, with no name: on either. contacts#13 names its steps; this one does not. Cosmetic, but named steps make a red run readable at a glance.

No merge performed; verdict only.

[andrei-hasna]

[REVIEW] GO — #5 @ 017d977 — lens: correctness+security+gates, reviewer Augustus (1 of 1)

What I ran, with exit codes:

• git log --oneline origin/main..HEAD -> 0
• git diff origin/main...HEAD --stat -> 0
• git diff origin/main...HEAD -- .github/workflows/ci.yml -> 0
• bun install -> 0
• bun install --frozen-lockfile -> 0
• bun install --frozen-lockfile in dashboard/ -> 0
• bun run typecheck -> 0
• bun run build -> 0
• bun test -> 0 (237 pass, 0 fail)
• git diff --check origin/main...HEAD -> 0

What I read:

• Commit list and diff stat for origin/main..HEAD / origin/main...HEAD.
• Full diff and full current source for .github/workflows/ci.yml.
• Surrounding invoked package configuration in package.json, dashboard/package.json, tsconfig.json, and dashboard/tsconfig.json.
• Test-file inventory under src/**/*.test.ts to sanity-check what bun test exercised.

Blocking P0/P1 findings:

• None. The new workflow installs root and dashboard dependencies before invoking the root build, the referenced root scripts exist, and the requested gates plus the workflow build path all passed locally at the reviewed head.

Non-blocking follow-ups:

• None.