Add PR CI workflow

[3uzbcqje]

Adds a pull_request-triggered build. Right now nothing in this repo verifies a PR at all — the existing workflows run on push to the default branch, after the merge. That is what makes the Dependabot PRs unreviewable: they look green because nothing is checking them.

Status

✅ Green, confirmed by this PR's own CI run, not just locally.

Notes

• CI: "false" on the build step. react-scripts promotes lint warnings to build errors whenever CI=true, which GitHub Actions sets automatically. My local run could not catch this (no CI var set); the first run of this workflow did. There are only 5, all trivial: 3× eqeqeq (== instead of ===) and 2 unused imports (useState, useEffect). Clear the warnings and drop that line to get the strict behaviour back.
• The test step is now enabled. src/App.test.js still asserted on the stock Create React App learn react link, which this app has never rendered, so the suite had been red since the app was written. It is replaced with a smoke test that mounts the component tree and asserts .app and .components rendered — a low bar, but the bar a dependency bump trips: an upgrade that still compiles but breaks rendering yields a blank page, which a build-only check cannot see. Verified: npm ci → build → 1/1 test passes.
• The test step passes --watchAll=false explicitly rather than relying on the CI variable, which would otherwise drop react-scripts into interactive watch mode and hang the job.

Conventions

• Actions pinned by commit SHA rather than tag, matching Equal-Vote/terraform.
• persist-credentials: false on checkout — otherwise the job token is left in .git/config, which the zizmor artipacked audit flags. Nothing here pushes.
• permissions: contents: read — least privilege.
• concurrency with cancel-in-progress, so a new push supersedes the in-flight run.

Every deviation above is explained inline in the workflow file, so the next person does not have to rediscover it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LpZM2dqedR4fXiLn7272XQ

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 3988fa77-1e33-45f8-8759-17c56b51bca3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}