feat: CI gate: run the existing test suite and typecheck on every PR in

[andrei-hasna]

Objective

CI gate: run the existing test suite and typecheck on every PR in servers — the repo has tests but no CI workflow at all [loop-infinity-300pr]

REPO: https://github.com/hasna/servers

WHAT TO CHANGE
This repo has a real test suite (17 test files at HEAD) and a test script, but there is no .github/workflows directory at all, so nothing runs on a pull request. Every PR — including the ones this pipeline opens — merges without a single automated check.

Add a single workflow at .github/workflows/ci.yml that runs on pull_request and on push to the default branch.

DONE LOOKS LIKE

• .github/workflows/ci.yml exists and runs, in one job: checkout, oven-sh/setup-bun, bun install --frozen-lockfile, bun run typecheck, bun run build, bun test.
• Pin the actions to a major version tag (for example actions/checkout@v4, oven-sh/setup-bun@v2) rather than @master.
• The workflow must actually be green on this PR. If the existing suite fails on a clean checkout, that is the finding — fix the smallest thing that makes it pass, or, if the failure is environmental (needs Postgres, needs a credential, needs a network service), scope the CI job to the subset that genuinely runs hermetically and say plainly in the PR body which suites were excluded and why. Do NOT make it green with continue-on-error, || true, or by skipping tests.
• No production source changed beyond what is needed to make the gate honest.

VERIFY

• The workflow run on this PR is green in GitHub Actions.
• bun install --frozen-lockfile && bun test reproduces the same result locally.

EVIDENCE
Checked 2026-07-29 against GitHub HEAD via the GitHub API: repos/hasna/servers/actions/workflows returned total_count 0, and the recursive git tree at HEAD contains 17 test files. package.json declares test=True, build=True, typecheck=True. If CI has since been added upstream, close this task as already-done with a one-line comment rather than opening an empty PR.

PROCESS: work in a branch off the default branch, one focused change, conventional commit, open a PR. Do not bundle unrelated cleanups. If the repo has a CHANGELOG, add an entry.

Verification

• policy source: base 9828392 (immutable commit — agent-proof)
• ⚠️ GATE-INTEGRITY: agent touched verify-bearing config — REVIEW (.github/workflows/ci.yml)
• containment: env — allowlist env, non-login shell, run-scoped HOME (registry auth seeded for install)
• install: pass
• typecheck: pass
• build: pass
• test: pass
• doctor (ci): ok — 11 checks passed (1 advisory)

---

Run run_901bd915cd8f · backend codewith · task 1a2b295c-e65b-4e58-b74c-5db34b31e4c4
🏭 Generated by @hasnaxyz/factory

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #9 @ 1cfda18 — lens: correctness+security+gates, reviewer Augustus (1 of 1)

What I ran, with exit codes:

• git log --oneline origin/main..HEAD -> 0; showed the single reviewed commit 1cfda18 feat: CI gate: run the existing test suite and typecheck on every PR in.
• git diff origin/main...HEAD --stat -> 0; showed .github/workflows/ci.yml and CHANGELOG.md, 23 insertions.
• git diff origin/main...HEAD -- .github/workflows/ci.yml -> 0; read full workflow diff.
• git diff origin/main...HEAD -- CHANGELOG.md -> 0; read full changelog diff.
• bun install -> 0.
• bun install --frozen-lockfile -> 0; additional check because the new workflow uses the frozen install gate.
• bun run typecheck -> 0.
• bun run build -> 0; additional check because the new workflow runs the build script.
• bun test -> 0; 284 pass, 0 fail.
• git status --short -> 0; worktree clean after gates.
• gh pr view 9 --repo hasna/servers --json number,state,headRefName,headRefOid,baseRefName,isCrossRepository,mergeable,mergeStateStatus,reviewDecision,url,title -> 0; PR was open, mergeable, clean, and still at the reviewed head SHA.

What I read:

• Full diff for every changed file: .github/workflows/ci.yml and CHANGELOG.md.
• Full new workflow file with line numbers.
• Surrounding changelog context at the top of CHANGELOG.md.
• package.json scripts that the workflow invokes: typecheck, build, and test.
• Existing repo gate/test references around README, package scripts, source tests, and test files to confirm the workflow commands correspond to real repo commands.
• PR metadata confirming headRefOid is 1cfda18e1fa945446be0a4e5422a9495650dfe74, base is main, and merge state is clean.

Blocking P0/P1 findings:

• None.

Non-blocking follow-ups:

• None.