Add PR CI workflow

.github/workflows/pr-ci.yml

@@ -0,0 +1,61 @@
+# Build check for pull requests.
+#
+# Without this, nothing verifies a pull request at all -- the only other
+# workflow runs on push to the default branch, after the merge. That makes
+# dependency bumps unreviewable in practice: the PR looks green because
+# nothing is checking it.
+#
+# Actions are pinned by commit SHA rather than tag, matching the convention
+# already used elsewhere in this org and required by the zizmor audit.
+#
+# The test step runs a render smoke test. It needs no OpenSSL workaround --
+# that is a webpack concern, and jest does not go through webpack.
+name: PR CI
+
+"on":
+  pull_request:
+
+# Read-only: this workflow never needs to write to the repo.
+permissions:
+  contents: read
+
+# A new push to a PR makes the in-flight run redundant.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # checkout leaves the job token in .git/config unless told
+          # otherwise. Nothing here pushes, so drop it (zizmor:
+          # artipacked).
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        env:
+          # react-scripts promotes lint warnings to build errors whenever
+          # CI=true, which Actions sets automatically. This repo carries
+          # pre-existing warnings, so leaving that on would make the check
+          # red for reasons unrelated to whether the app builds. Clear the
+          # warnings, then drop this line to get the strict behaviour back.
+          CI: "false"
+        run: npm run build
+
+      - name: Test
+        # --watchAll=false explicitly, rather than depending on the CI
+        # environment variable: react-scripts drops into interactive watch
+        # mode whenever CI is unset, which would hang the job indefinitely.
+        # Being explicit keeps the step correct regardless of environment.
+        run: npm test -- --watchAll=false