Add a CI workflow running typecheck, tests, build, and a version-lockstep check

[cb-jeeves]

Problem

There is no .github/ directory in the repository — no workflow runs on pull requests or on pushes to main.

The project has plenty to verify. The root package.json defines typecheck (npm run typecheck --workspaces), test (vitest run), and build (all four workspaces in dependency order), and there are 107 *.test.ts files across the packages. None of it runs automatically.

The release path makes this sharper. The README documents publishing as:

npm run set-version -- 0.2.0
npm run build
npm publish --workspaces

scripts/set-version.mjs exists precisely because all four @copperbox packages plus the root must share one version, and every internal @copperbox/millwright-* dependency range must be rewritten to ^<version> in lockstep. Today all five manifests are at 0.6.2 and agree — but nothing checks that, so a hand-edited version or a partially applied bump would only be caught after four packages were already on the npm registry, and the README states that no upgrade path between versions is maintained.

The sibling repos already run CI: dispatch has .github/workflows/ci.yml mirroring its root verify script, and clipless has build and test workflows. millwright, despite being the largest test suite of the group and the only one that publishes to npm, has none.

Proposal

Add a single .github/workflows/ci.yml that runs on pull requests and on pushes to main, with permissions: contents: read and concurrency cancellation for superseded runs on the same ref. Follow dispatch's ci.yml as the house style — one verify job whose steps mirror the root package scripts, so the workflow and package.json stay in obvious correspondence:

• npm ci
• npm run typecheck
• npm test
• npm run build
• a version-lockstep check

For the lockstep check, add a --check mode to scripts/set-version.mjs (rather than a second script that could drift from it): with --check and no version argument, read the root version, assert every entry in packageDirs carries that same version, assert every @copperbox/millwright-* dependency range across all four dependency blocks equals ^<version>, assert each src/version.ts VERSION constant matches, and exit non-zero listing every mismatch. Expose it as an npm script and run it as a CI step. This mirrors the drift-guard pattern dispatch uses with sync:agents:check.

Node 22, actions/setup-node with cache: npm.

Out of scope: publishing or release automation (releases stay manual, as documented), AWS-touching integration tests, coverage thresholds, and branch-protection configuration.

Value

Two audiences. Contributors — the README explicitly invites bug reports from people trying millwright — currently get no signal on a pull request and have to trust that a reviewer ran the suite locally across four workspaces. And the operator publishing a release gets a mechanical guarantee that the version lockstep the packages depend on actually holds, instead of finding out from a broken install of a mismatched @copperbox/millwright-cdk and @copperbox/millwright-cli pair.

You would know it worked by opening a pull request and seeing the verify job report; by confirming a deliberate type error or failing test turns it red; and by hand-editing one package's version to 0.6.3 and confirming the lockstep step fails and names that package.

[cb-jeeves]

Assessment: The ask is clear and well-scoped: add a single .github/workflows/ci.yml running on PRs and pushes to main (contents:read permission, concurrency cancellation, Node 22 with actions/setup-node cache: npm) that mirrors the root package.json scripts via npm ci, typecheck, test, build, plus a new version-lockstep check. That check is precisely specified as a --check flag on the existing scripts/set-version.mjs, comparing root version against packageDirs, internal @copperbox/millwright-* dependency ranges, and each src/version.ts VERSION constant, exiting non-zero with the mismatches listed. Scope is explicitly bounded (no publish automation, no AWS integration tests, no coverage gates, no branch protection), and dispatch's existing ci.yml gives a concrete style reference to follow. Verification is straightforward: open a PR and see the job run, confirm a deliberate type error or test failure goes red, and confirm a hand-edited version mismatch is caught and named. I don't see open questions blocking a start.

I'll begin work on this shortly.

[cb-jeeves]

Review pass complete on freight/issue-35: workflow, --check mode, tests, and docs are clean; typecheck and the full suite pass, no changes made.