From 703b4bfc3092b20142c506ff168fc3aa8b4b57c4 Mon Sep 17 00:00:00 2001
From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com>
Date: Fri, 17 Jul 2026 10:12:08 +0200
Subject: [PATCH 1/3] ci: add golden verification floor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Wires the shared CI floor (see dotfiles/templates/ci) so main is defended by
lint + typecheck + test + build on every push and PR. npm monorepo — gates frontend lint/typecheck/build (e2e deferred).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 52 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..81447c8a
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,52 @@
+# Golden CI floor — see dotfiles/templates/ci/README.md.
+# datacat: npm monorepo (frontend/ + backend/). The only tests are full-stack
+# Playwright e2e that need both servers + a DB running — NOT hermetic, so they
+# are deferred to a future e2e job (lift revampit's e2e-local pattern once a
+# seeded DB service is wired). This floor gates the frontend quality signals
+# that currently never run: lint, typecheck, build (contentlayer + prisma
+# generate + next build). The frontend needs --legacy-peer-deps (proven in the
+# old deploy workflow). The production Docker deploy stays disabled — enabling a
+# deploy is an outward-facing decision, not part of the CI floor.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify-frontend:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install
+        run: npm ci --legacy-peer-deps
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Typecheck
+        run: npx tsc --noEmit
+
+      - name: Build (contentlayer + prisma generate + next build)
+        env:
+          # prisma generate reads the datasource url but does not connect.
+          DATABASE_URL: postgres://ci:ci@localhost:5432/ci
+        run: npm run build

From 54daa212548bbc749683a27c9b6365ffafe2c56c Mon Sep 17 00:00:00 2001
From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com>
Date: Fri, 17 Jul 2026 10:16:38 +0200
Subject: [PATCH 2/3] ci: pin Node 18 for datacat (contentlayer crashes on exit
 under Node 20+)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 81447c8a..a4052cf7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,7 +32,10 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          # Node 18: contentlayer (unmaintained) crashes on exit under Node 20+
+          # (ERR_INVALID_ARG_TYPE in clipanion) even though it generates docs
+          # fine. The old deploy workflow pinned 18 for the same reason.
+          node-version: 18
           cache: npm
           cache-dependency-path: frontend/package-lock.json
 

From a16719e6481a4462608c0005410967efa9ae1c3b Mon Sep 17 00:00:00 2001
From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com>
Date: Fri, 17 Jul 2026 10:22:07 +0200
Subject: [PATCH 3/3] ci: defer build (prisma engine issue); floor =
 lint+typecheck

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a4052cf7..6910e64b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -48,8 +48,10 @@ jobs:
       - name: Typecheck
         run: npx tsc --noEmit
 
-      - name: Build (contentlayer + prisma generate + next build)
-        env:
-          # prisma generate reads the datasource url but does not connect.
-          DATABASE_URL: postgres://ci:ci@localhost:5432/ci
-        run: npm run build
+      # Build is DEFERRED, not skipped silently. `prisma generate` currently
+      # fails in CI on a missing engine (query_engine_bg.postgresql.wasm) — a
+      # repo tooling issue to fix separately, not a gate-worthy signal. The
+      # full-stack Playwright e2e is also deferred (needs both servers + a DB).
+      # This floor gates the frontend signals that never ran before:
+      # lint + typecheck. Add build + e2e once the prisma engine is resolved
+      # (revampit e2e-local pattern in dotfiles/templates/ci/README.md).