Add PR CI workflow and commit package-lock.json

[3uzbcqje]

Adds a pull_request-triggered build. Right now nothing in this repo verifies a PR at all — the existing workflows run on push to the default branch, after the merge. That is what makes the Dependabot PRs unreviewable: they look green because nothing is checking them.

Status

✅ Green, confirmed by this PR's own CI run, not just locally.

Notes

• npm ci, from the package-lock.json this PR now commits. Without one, npm ci could not run, the setup-node npm cache was unavailable, and Dependabot could only ever update the ranges in package.json — it had nowhere to pin transitive dependencies. Verified: npm ci from a clean tree, then npm run build, both pass.
• NODE_OPTIONS=--openssl-legacy-provider: webpack 4 hashing vs OpenSSL 3 on modern Node.
• CI: "false" on the build step. react-scripts promotes lint warnings to build errors whenever CI=true, which GitHub Actions sets automatically. My local run could not catch this (no CI var set); the first run of this workflow did. Clear the warnings and drop that line to get the strict behaviour back.
• The test step is now enabled and runs 9 parser/tally tests. test1 tie breaking had never passed, but not for a domain reason: import data from "./simple.csv" resolves to the filename string "simple.csv" under Create React App's jest config (unknown extensions go through fileTransform), so parse() was handed a filename and returned null. The fixture is now read from disk with fs.readFileSync. The assertion itself was correct all along — Dylan and Eliza do win. Verified: npm ci → npm run build → 9/9 tests pass.
• The test step needs no OpenSSL workaround; that is a webpack concern and jest does not go through webpack. It passes --watchAll=false explicitly rather than relying on the CI variable, which would otherwise drop react-scripts into interactive watch mode and hang the job.

Conventions

• Actions pinned by commit SHA rather than tag, matching Equal-Vote/terraform.
• persist-credentials: false on checkout — otherwise the job token is left in .git/config, which the zizmor artipacked audit flags. Nothing here pushes.
• permissions: contents: read — least privilege.
• concurrency with cancel-in-progress, so a new push supersedes the in-flight run.

Every deviation above is explained inline in the workflow file, so the next person does not have to rediscover it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LpZM2dqedR4fXiLn7272XQ

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 1f91d718-fbe8-4555-bbd5-64719a52b279

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}