chore: add a dependency watcher #88

	name: CI

	# The verification that used to live inside the Vercel deploy workflow. It
	# belongs in its own file: prod is self-hosted on bitbaum, so the deploy
	# workflow is now a shim over the shared pipeline — and that pipeline refuses
	# to ship a commit whose CI is not green. Without this file there would be no
	# CI to be green, and every deploy would sail through unverified.

	on:
	workflow_dispatch: {}
	push:
	branches: [main]
	pull_request:

	concurrency:
	group: ci-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	verify:
	name: Format, lint, test, build
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version-file: .nvmrc
	cache: npm

	- run: npm ci

	# SSOT: format + lint + typecheck + test + build are bundled in the
	# `verify` npm script (package.json), and CI calls it verbatim so the
	# gating chain cannot drift from what a developer runs locally. This job
	# was already NAMED verify but re-inlined the chain, which is how the
	# typecheck gate went missing: `tsc --noEmit` ran nowhere, and type
	# errors were caught only as a side effect of `next build`.
	#
	# The `--if-present` flags are gone on purpose. They made three of these
	# gates unable to fail: rename or delete the `lint` script and the step
	# passes green instead of erroring. A gate that cannot go red is not a
	# gate — the same defect that let evig ship 25 failing tests under a ✓.
	- name: Verify (format + lint + typecheck + test + build)
	run: npm run verify

Navigation Menu