From 92159c653c804077ec4be60c0ffee44a85bf71c1 Mon Sep 17 00:00:00 2001
From: abhinav-phi <alpha9coder@gmail.com>
Date: Sat, 29 Aug 2026 19:11:45 +0530
Subject: [PATCH] ci: enforce lint + strict tsc + tests + build on every PR
 (R22)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a GitHub Actions workflow with four gates (npm ci, eslint, strict typecheck,
vitest, production build) on PRs and pushes to main. Unblocks lint, which was
failing with no-explicit-any errors in the two Deno edge functions: their
deno-lint directive silences Deno's linter, not ESLint — add a scoped,
documented eslint-disable (raw JSON boundaries are deliberate; Deno type-checks
these at deploy time).
---
 .github/workflows/ci.yml                      | 37 +++++++++++++++++++
 .../functions/verify-anchor-receipt/index.ts  |  4 ++
 .../functions/verify-wallet-link/index.ts     |  4 ++
 3 files changed, 45 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..d311fd3
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,37 @@
+name: CI
+
+# Enforces Rule R22 (lint + typecheck + tests + build pass before push) on
+# every PR and every push to main. The four gates mirror the local commands in
+# MANUAL_STEPS.md Step E.
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies (exact lockfile)
+        run: npm ci
+
+      - name: Lint (errors fail; warnings reported)
+        run: npm run lint
+
+      - name: Type-check (strict mode)
+        run: npx tsc --noEmit -p tsconfig.app.json
+
+      - name: Unit tests
+        run: npm test
+
+      - name: Production build
+        run: npm run build
diff --git a/supabase/functions/verify-anchor-receipt/index.ts b/supabase/functions/verify-anchor-receipt/index.ts
index 7899c5f..92939d1 100644
--- a/supabase/functions/verify-anchor-receipt/index.ts
+++ b/supabase/functions/verify-anchor-receipt/index.ts
@@ -1,4 +1,8 @@
 // Supabase Edge Function: verify-anchor-receipt (audit F4 residual)
+
+/* eslint-disable @typescript-eslint/no-explicit-any -- Deno edge function: raw JSON-RPC and
+   PostgREST JSON boundaries are deliberately untyped here; this file is excluded from the
+   Vite app typecheck and is type-checked by Deno at deploy time. */
 // Server-side confirmation of a Sepolia anchoring transaction.
 //
 // Why: products.blockchain_tx_status is currently manufacturer-asserted —
diff --git a/supabase/functions/verify-wallet-link/index.ts b/supabase/functions/verify-wallet-link/index.ts
index 8baf473..b0e5b64 100644
--- a/supabase/functions/verify-wallet-link/index.ts
+++ b/supabase/functions/verify-wallet-link/index.ts
@@ -1,4 +1,8 @@
 // Supabase Edge Function: verify-wallet-link (audit MEDIUM #7)
+
+/* eslint-disable @typescript-eslint/no-explicit-any -- Deno edge function: raw JSON-RPC and
+   PostgREST JSON boundaries are deliberately untyped here; this file is excluded from the
+   Vite app typecheck and is type-checked by Deno at deploy time. */
 // Server-side ECDSA verification of the wallet-linking signature.
 //
 // Why: `link_wallet_address` only FORMAT-checks the signature (^0x…130$) — the