From 77874c9a2540fcbc4f6d654d4636f1082e5ff921 Mon Sep 17 00:00:00 2001
From: Aaron Sachs <898627+asachs01@users.noreply.github.com>
Date: Thu, 3 Sep 2026 09:52:07 -0400
Subject: [PATCH] ci: add PR-triggered CI workflow

Adds a CI workflow running on pull_request and push to main so automated
checks gate every code change (Vanta: github-code-change-automated-checks-enabled).

Claude-Session: https://claude.ai/code/session_01LYL1ivhJKNwnHRCdTSuAom
---
 .github/workflows/ci.yml | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..5fc01a4
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,40 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [22.x, 24.x]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Install dependencies
+        run: npm ci
+
+      # NOTE: `npm run lint` is omitted — the repo has a legacy .eslintrc.cjs
+      # with ESLint >=9 installed, so eslint exits 2 until the config is
+      # migrated to eslint.config.*. Type checking still runs below.
+
+      - name: Run type check
+        run: npm run typecheck
+
+      - name: Build
+        run: npm run build
+
+      - name: Run tests
+        run: npm test