Add PR CI workflow and commit package-lock.json

[3uzbcqje]

Adds a pull_request-triggered build. Right now nothing in this repo verifies a PR at all — the existing workflows run on push to the default branch, after the merge. That is what makes the Dependabot PRs unreviewable: they look green because nothing is checking them.

Status

✅ Green, confirmed by this PR's own CI run, not just locally.

Notes

• npm ci, from the package-lock.json this PR now commits. It was previously listed in .gitignore, so every install resolved dependencies fresh and Dependabot had no lockfile in which to pin transitive dependencies. A published package's lockfile is not consumed downstream — npm ignores a dependency's lockfile when installing it — so committing it only pins this repo's own CI and development installs. Verified: npm ci from a clean tree, then npm run build, both pass.
• NODE_OPTIONS=--openssl-legacy-provider: react-scripts here builds on webpack 4, whose hashing OpenSSL 3 rejects on modern Node (error:0308010C:digital envelope routines::unsupported).
• CI: "false" on the build step. react-scripts promotes lint warnings to build errors whenever CI=true, which GitHub Actions sets automatically. My local run could not catch this (no CI var set); the first run of this workflow did. The warnings here are mostly no-loop-func in the tally code (Function declared in a loop contains unsafe references to 'weighted_scores', 'ballot_weights', 'roundTies', and similar around lines 432-487). Those deserve a real look rather than a lint silence — closures capturing mutable loop variables is a genuine bug class, and this is vote-counting code. Clear the warnings and drop that line to get the strict behaviour back.
• No test step: npm test fails on "True Tie Test" (src/Tests/ties.test.js:61), 1 failed / 10 passed, on the default branch. Combined with the no-loop-func warnings above, the tie-handling path looks worth auditing.

Conventions

• Actions pinned by commit SHA rather than tag, matching Equal-Vote/terraform.
• persist-credentials: false on checkout — otherwise the job token is left in .git/config, which the zizmor artipacked audit flags. Nothing here pushes.
• permissions: contents: read — least privilege.
• concurrency with cancel-in-progress, so a new push supersedes the in-flight run.

Every deviation above is explained inline in the workflow file, so the next person does not have to rediscover it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LpZM2dqedR4fXiLn7272XQ

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 6c02f056-c007-47cd-a68e-4b6f3baddaba

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}