No CI: the test suite has never run on a pull request #49

There is no .github/workflows/ in this repo at all. The bun test suite (test, test:unit, test:e2e) has only ever been run by hand, locally, by whoever happened to remember.

That is a gap worth closing on a public repo with stars and several open PRs: a contributor opening a PR gets no signal, and neither does a reviewer.

Noticed while looking for somewhere to put a content check — the answer was "there is nowhere", which is the finding.

Shape

A single workflow on push: [main] and pull_request: [main] running test:unit would cover most of it. test:e2e needs playwright browsers, so it is a second, slower job (or a nightly) rather than part of the same gate.

Per the house supply-chain rules: pin every action to a full 40-char commit SHA resolved from a published tag, keep the third-party action count at zero if actions/checkout plus inline shell will do, and set least-privilege permissions: (contents: read is enough).

Worth knowing before wiring it up

The sibling ops repo's flake-update workflow opens PRs with GITHUB_TOKEN, and those PRs land their check run in action_required — parked, invisible, needing a manual gh api .../approve. One sat unnoticed for over three weeks. If any workflow here is ever triggered by a bot-authored PR, expect the same and plan for a PAT or App token.

Related: ~/.npmrc-style ignore-scripts settings mean pre/post script hooks are silently skipped locally but not in CI, so local-vs-CI divergence is a real failure mode for this project — another argument for having CI at all.