feat: CI gate: run the existing test suite and typecheck on every PR in

[andrei-hasna]

Objective

CI gate: run the existing test suite and typecheck on every PR in mcps — the repo has tests but no CI workflow at all [loop-infinity-300pr]

REPO: https://github.com/hasna/mcps

WHAT TO CHANGE
This repo has a real test suite (26 test files at HEAD) and a test script, but there is no .github/workflows directory at all, so nothing runs on a pull request. Every PR — including the ones this pipeline opens — merges without a single automated check.

Add a single workflow at .github/workflows/ci.yml that runs on pull_request and on push to the default branch.

DONE LOOKS LIKE

• .github/workflows/ci.yml exists and runs, in one job: checkout, oven-sh/setup-bun, bun install --frozen-lockfile, bun run typecheck, bun run build, bun test.
• Pin the actions to a major version tag (for example actions/checkout@v4, oven-sh/setup-bun@v2) rather than @master.
• The workflow must actually be green on this PR. If the existing suite fails on a clean checkout, that is the finding — fix the smallest thing that makes it pass, or, if the failure is environmental (needs Postgres, needs a credential, needs a network service), scope the CI job to the subset that genuinely runs hermetically and say plainly in the PR body which suites were excluded and why. Do NOT make it green with continue-on-error, || true, or by skipping tests.
• No production source changed beyond what is needed to make the gate honest.

VERIFY

• The workflow run on this PR is green in GitHub Actions.
• bun install --frozen-lockfile && bun test reproduces the same result locally.

EVIDENCE
Checked 2026-07-29 against GitHub HEAD via the GitHub API: repos/hasna/mcps/actions/workflows returned total_count 0, and the recursive git tree at HEAD contains 26 test files. package.json declares test=True, build=True, typecheck=True. If CI has since been added upstream, close this task as already-done with a one-line comment rather than opening an empty PR.

PROCESS: work in a branch off the default branch, one focused change, conventional commit, open a PR. Do not bundle unrelated cleanups. If the repo has a CHANGELOG, add an entry.

Verification

• policy source: base e0029c0 (immutable commit — agent-proof)
• ⚠️ GATE-INTEGRITY: agent touched verify-bearing config — REVIEW (.github/workflows/ci.yml)
• containment: env — allowlist env, non-login shell, run-scoped HOME (registry auth seeded for install)
• install: pass
• typecheck: pass
• build: pass
• test: pass
• doctor (ci): ok — 11 checks passed (1 advisory)

---

Run run_c11ce331adc0 · backend codewith · task 76d3ac7d-4c75-486b-a876-7944e0450d0a
🏭 Generated by @hasnaxyz/factory

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #6 @ 395f353 — lens: correctness+security+gates, reviewer Augustus (1 of 1)

What I ran, with exit codes:

• git rev-parse HEAD -> 0; confirmed 395f3537d8ef2c285a57b74bee77242952a91e75.
• git log --oneline origin/main..HEAD -> 0; read the single PR commit 395f353 feat: CI gate: run the existing test suite and typecheck on every PR in.
• git diff origin/main...HEAD --stat -> 0; one changed file, .github/workflows/ci.yml, 29 insertions.
• git diff origin/main...HEAD -- .github/workflows/ci.yml -> 0; read the full workflow patch.
• bun install -> 0.
• bun run typecheck -> 0.
• bun run build -> 0.
• bun test -> 0; 229 pass, 0 fail.
• bun install --frozen-lockfile -> 0; also verified the exact install command added to CI.

What I read:

• Full diff and full contents of .github/workflows/ci.yml.
• Surrounding repo setup in package.json, including typecheck, build, test, and the dashboard build path.
• tsconfig.json and hasna.contract.json to verify the workflow targets the repo’s actual TypeScript/package shape.

Blocking P0/P1 findings:

• None. The workflow references scripts that exist, the CI install mode is compatible with the committed lockfile, and the required local gates pass.

Non-blocking follow-ups:

• P2: For supply-chain hardening, consider pinning third-party GitHub Actions by commit SHA instead of mutable tags (actions/checkout@v4, oven-sh/setup-bun@v2). This is not a blocker for this PR because the workflow does not use secrets or privileged write steps.