From a2c64e7940667ba4a4f580658b294a953b4eab90 Mon Sep 17 00:00:00 2001
From: 3uzbcqje <3uzbcqje@addy.to>
Date: Fri, 11 Sep 2026 12:03:19 -0700
Subject: [PATCH] Add PR CI workflow

Nothing currently verifies a pull request in this repo: the existing
workflows run on push to the default branch, after the merge. That makes
dependency bumps unreviewable in practice -- a Dependabot PR looks green
because nothing is checking it.

This adds a pull_request-triggered build. Actions are pinned by commit SHA
and checkout runs with persist-credentials: false, matching the convention
used elsewhere in the org and satisfying the zizmor audit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LpZM2dqedR4fXiLn7272XQ
---
 .github/workflows/pr-ci.yml | 51 +++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 .github/workflows/pr-ci.yml

diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
new file mode 100644
index 0000000..ca58057
--- /dev/null
+++ b/.github/workflows/pr-ci.yml
@@ -0,0 +1,51 @@
+# Build check for pull requests.
+#
+# Without this, nothing verifies a pull request at all -- the only other
+# workflow runs on push to the default branch, after the merge. That makes
+# dependency bumps unreviewable in practice: the PR looks green because
+# nothing is checking it.
+#
+# Actions are pinned by commit SHA rather than tag, matching the convention
+# already used elsewhere in this org and required by the zizmor audit.
+#
+# Node matches .sandcastle/Dockerfile. There is no lint step yet: `npm run
+# lint` currently crashes before reaching the code --
+# @typescript-eslint/no-unused-expressions is incompatible with the installed
+# eslint 9.15 ("Cannot read properties of undefined (reading
+# allowShortCircuit)"). Re-add the step once that pairing is resolved; a
+# Dependabot bump of either package may well fix it.
+name: PR CI
+
+"on":
+  pull_request:
+
+# Read-only: this workflow never needs to write to the repo.
+permissions:
+  contents: read
+
+# A new push to a PR makes the in-flight run redundant.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # checkout leaves the job token in .git/config unless told
+          # otherwise. Nothing here pushes, so drop it (zizmor:
+          # artipacked).
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build