From 0d4c19821e287be36cc61db114c634036d75f8d1 Mon Sep 17 00:00:00 2001
From: Daniel Clayton <dan@Daniels-Mac-mini.local>
Date: Sun, 1 Mar 2026 21:09:28 -0700
Subject: [PATCH 1/2] chore: establish p0 CI baseline and workflow generator
 contract snapshot

---
 .github/workflows/ci.yml                      | 49 ++++++++++++++-----
 package.json                                  |  5 +-
 .../workflow-generator.test.ts.snap           | 28 +++++++++++
 packages/core/src/workflow-generator.test.ts  | 35 +++++++++++++
 4 files changed, 104 insertions(+), 13 deletions(-)
 create mode 100644 packages/core/src/__snapshots__/workflow-generator.test.ts.snap

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d2ae84c..685824c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,17 +1,42 @@
-name: CI Workflow
+name: CI
+
 on:
   push:
-    branches:
-      - main
-  pull_request: {}
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
-  test:
-    name: Test
+  quality:
+    name: Quality checks
     runs-on: ubuntu-latest
+
     steps:
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-      - name: Hello World
-        run: echo "Hello from my construct!"
-      - name: Show Environment
-        run: 'echo "Environment: production"'
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.2.22
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build
+        run: bun run build
+
+      - name: Typecheck
+        run: bun run typecheck
+
+      - name: Lint
+        run: bun run lint
+
+      - name: Contract tests (workflow generator)
+        run: bun run test -- packages/core/src/workflow-generator.test.ts
diff --git a/package.json b/package.json
index 1a04a79..320934f 100644
--- a/package.json
+++ b/package.json
@@ -5,6 +5,9 @@
   "private": true,
   "scripts": {
     "build": "bun run --filter './packages/*' build",
+    "typecheck": "bun run build",
+    "lint": "echo 'lint rules pending (tracked in backlog)'",
+    "format:check": "bunx prettier --check .",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:ui": "vitest --ui",
@@ -32,7 +35,7 @@
   "peerDependencies": {
     "typescript": "^5"
   },
-  "packageManager": "bun@1.1.40",
+  "packageManager": "bun@1.2.22",
   "dependencies": {
     "@changesets/cli": "^2.29.5",
     "axios": "^1.7.0",
diff --git a/packages/core/src/__snapshots__/workflow-generator.test.ts.snap b/packages/core/src/__snapshots__/workflow-generator.test.ts.snap
new file mode 100644
index 0000000..9625f72
--- /dev/null
+++ b/packages/core/src/__snapshots__/workflow-generator.test.ts.snap
@@ -0,0 +1,28 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`workflow-generator > generateWorkflowYaml > should keep workflow/job/step key ordering stable 1`] = `
+"# This file is autogenerated by DotGitHub. Do not edit manually.
+name: Ordered Workflow
+on:
+  push:
+    branches:
+      - main
+permissions:
+  actions: read
+  contents: read
+env:
+  CI: "true"
+concurrency:
+  group: \${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  test:
+    name: Test Job
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run tests
+        run: bun test
+"
+`;
diff --git a/packages/core/src/workflow-generator.test.ts b/packages/core/src/workflow-generator.test.ts
index 4a34c16..87c3637 100644
--- a/packages/core/src/workflow-generator.test.ts
+++ b/packages/core/src/workflow-generator.test.ts
@@ -185,6 +185,41 @@ describe('workflow-generator', () => {
       expect(yaml).toContain('continue-on-error: true');
       expect(yaml).toContain('working-directory: ./src');
     });
+
+    it('should keep workflow/job/step key ordering stable', () => {
+      const workflow: GitHubWorkflow = {
+        name: 'Ordered Workflow',
+        on: {
+          push: { branches: ['main'] },
+        },
+        permissions: {
+          contents: 'read',
+          actions: 'read',
+        },
+        env: {
+          CI: 'true',
+        },
+        concurrency: {
+          group: '${{ github.workflow }}-${{ github.ref }}',
+          'cancel-in-progress': true,
+        },
+        jobs: {
+          test: {
+            name: 'Test Job',
+            permissions: { contents: 'read' },
+            'runs-on': 'ubuntu-latest',
+            steps: [
+              {
+                name: 'Run tests',
+                run: 'bun test',
+              },
+            ],
+          },
+        },
+      };
+
+      expect(generateWorkflowYaml(workflow)).toMatchSnapshot();
+    });
   });
 
   describe('createWorkflow', () => {

From b3774dae1f03a3a547b5c4c13b68bb54bd4207f1 Mon Sep 17 00:00:00 2001
From: Daniel Clayton <dan@Daniels-Mac-mini.local>
Date: Sun, 1 Mar 2026 21:13:03 -0700
Subject: [PATCH 2/2] fix: build core before cli to satisfy workspace type
 resolution in CI

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 320934f..80f1ddd 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
   "type": "module",
   "private": true,
   "scripts": {
-    "build": "bun run --filter './packages/*' build",
+    "build": "bun run --filter @dotgithub/core build && bun run --filter @dotgithub/cli build",
     "typecheck": "bun run build",
     "lint": "echo 'lint rules pending (tracked in backlog)'",
     "format:check": "bunx prettier --check .",