[scasella]

Outside pull requests (#10, #11, #12) reported passing checks, but nothing verified them. This adds one workflow, .github/workflows/ci.yml, that runs the three checks CONTRIBUTING.md requires on every pull request and on each push to main:

1. claude plugin validate .
2. claude plugin test .
3. npx -p typescript tsc -p .

Green run on this branch (772ea5e): https://github.com/scasella/claude-flightdeck/actions/runs/40091015254 (the first commit's run, https://github.com/scasella/claude-flightdeck/actions/runs/40090843947, was green too). CLI 2.1.309, validate passed (only the existing icon warning), 46/46 tests, types written in about 2s, tsc clean, no orphan processes at cleanup.

How it works

• Install. npm install -g @anthropic-ai/claude-code@2.1.309 on Node 24. The npm package installs the native linux-x64 binary as an optional dependency, and npm checks its integrity. setup-node caches ~/.npm, keyed on the workflow file, so changing a pinned version busts the cache. DISABLE_AUTOUPDATER and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC keep the pinned CLI from updating itself or sending telemetry.
• No credentials. plugin validate and plugin test make no model call; both pass locally with an empty CLAUDE_CONFIG_DIR and pass here with no secrets. The workflow reads no secrets, has contents: read only, and checks out without persisting the token, so fork PRs run it the same way.
• Types for tsc. .claude-plugin/types/ is written only when an interactive session loads the mod from --plugin-dir. The plugin-authoring reference says a --plugin-dir folder under claude -p "is never written in", which matches what we saw. So the workflow:
  • writes a throwaway .claude.json (onboarding done, this folder trusted), so the session starts without a login screen or trust dialog;
  • starts claude --plugin-dir . under util-linux script (a pty), with stdin held open, in its own process group;
  • waits up to 60s for tsconfig.json and the three index.d.ts files (locally they appear in about 2s), then kills the group;
  • fails unless the API file's first line says Written by Claude Code 2.1.309., and prints the session's screen when that check fails, so a new first-run dialog in a later CLI shows up in the log.
• TypeScript is pinned to 7.0.2, the version tsc was verified clean with. Locally, a planted type error makes it exit 1, so the step really gates. CONTRIBUTING's unpinned npx -p typescript stays as it is for people running it locally.

To move to a newer Claude Code or TypeScript, change CLAUDE_CODE_VERSION or TYPESCRIPT_VERSION at the top of the workflow.

Not verified before merge

• The push: main trigger first runs once this is merged. The job is the same one as on the pull request.
• Depending on the repository's Actions settings, a first-time contributor's fork PR may need a maintainer to approve the run.

CONTRIBUTING.md gets one line saying CI runs the three checks. Hooks, tests and README are not touched.

🤖 Generated with Claude Code