From 7964d9b71fc0ad8acfa04d7e5fe7660b294c2cbf Mon Sep 17 00:00:00 2001
From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com>
Date: Sun, 16 Aug 2026 13:09:55 +0200
Subject: [PATCH] =?UTF-8?q?ci:=20adopt=20the=20golden=20CI=20floor=20?=
 =?UTF-8?q?=E2=80=94=20nothing=20was=20running=20verify?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The repo shipped with a `verify` script and no workflow, so nothing ran it on
push or PR. The fleet's conformance checker caught it on its first sweep, which
is a fair result for a package published an hour earlier and a reminder that the
gap is never 'no gate' — it is a gate nobody wired up.

`npm test` here also exercises the package's `exports` map, because the tests
import it BY NAME rather than reaching into dist/. A broken exports or files list
therefore fails here rather than at the first consumer's install.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..459c927
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,39 @@
+# GOLDEN CI FLOOR — npm. See dotfiles/templates/ci/README.md.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+# A newer push makes the older run obsolete — don't waste minutes finishing it.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install
+        run: npm ci
+
+      # SSOT: "verified" is defined ONCE, in package.json `verify`
+      # (= build + test), and run identically here and locally. Change the
+      # checks in one place, not two.
+      #
+      # `npm test` here also exercises the package's `exports` map, because the
+      # tests import it BY NAME rather than reaching into dist/ — so a broken
+      # exports/files map fails here rather than at a consumer's install.
+      - name: Verify
+        run: npm run verify