ci: add GitHub Actions pipeline and Dependabot config#6
Merged
Conversation
The project ships a full typecheck/lint/test/build toolchain and receives Dependabot dependency PRs, but nothing ran those checks automatically. Add a CI workflow that runs them on every push and PR to main, plus a Dependabot config so version updates arrive as grouped weekly PRs. - .github/workflows/ci.yml: typecheck -> lint -> build -> test across Node 20 and 22. The suite is hermetic (dummy key via vitest.config.ts, Supabase/Neo4j/embeddings unset), so no secrets or services are needed. - .github/dependabot.yml: grouped weekly npm and github-actions updates. - README: CI status badge and a Continuous integration note. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017ZB4NjNJZ6zWTqypbSiihy
daemon-blockint-tech
marked this pull request as ready for review
July 18, 2026 00:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
The project is in strong shape —
typecheck,lint,test(31 tests), andbuildall pass cleanly, with no TODOs or stubs. But it ships a full quality toolchain and already receives Dependabot dependency PRs, yet nothing runs those checks automatically. This PR closes that infrastructure gap so regressions and dependency bumps are validated before merge.What changed
.github/workflows/ci.yml— CI on every push and pull request tomain, running the exact commands the README documents:typecheck → lint → build → test, across a Node 20 + 22 matrix (matchingengines.node >= 20). The suite is hermetic (dummyOPENROUTER_API_KEYviavitest.config.ts; Supabase/Neo4j/embeddings unset), so CI needs no secrets or services. Includes concurrency cancellation and read-only permissions..github/dependabot.yml— grouped weekly version updates fornpmandgithub-actions, complementing the security updates already active on the repo.README.md— CI status badge and a short Continuous integration note.Verification
Ran the full CI sequence locally on Node 22 — all green:
Both YAML files validate. No application/source code is touched — this is CI/tooling only.
Notes / follow-ups (not in this PR)
npm auditreports vulnerabilities that are all transitive through@solana/web3.jsand only fixable via breaking major bumps, so they were intentionally left out of scope. CI deliberately does not run a blockingnpm auditstep for the same reason.crystalline-store, retrieval utils) as a separate follow-up.🤖 Generated with Claude Code
https://claude.ai/code/session_017ZB4NjNJZ6zWTqypbSiihy
Generated by Claude Code