feat: CI workflow for lint, test, and smoke checks (Closes #29)

[laurentketterle-hub]

Closes #29

Adds a comprehensive CI workflow that runs on every PR and push to master:

Checks performed

• ESLint — JavaScript linting via
• Markdown lint — Documentation quality via
• Prettier format — Code formatting check via
• Tests — Full test suite via
• Smoke — Lightweight smoke test via
• API validation — Endpoint validation via

Design

• Runs on with Node.js version from
• Uses for deterministic installs
• 15-minute timeout — practical for contributors
• Clear pass/fail status on every PR

Signed-off-by: laurentketterle-hub laurentketterle-hub@users.noreply.github.com

Summary by CodeRabbit

• Chores
  • Added automated checks for code quality, formatting, documentation, unit tests, smoke tests, and API validation.
  • Checks run automatically for updates and proposed changes, helping identify issues before release.
  • The workflow uses the project’s specified Node.js version and consistent dependency installation settings for reliable results.

[coderabbitai]

📝 Walkthrough

Walkthrough

Added a GitHub Actions workflow for pushes and pull requests targeting master. The workflow installs the configured Node.js version, installs dependencies, and runs lint, formatting, unit, smoke, and API validation checks.

Changes

Continuous Integration Workflow

Layer / File(s)	Summary
Workflow triggers and environment .github/workflows/ci.yml	The workflow runs on pushes and pull requests targeting master. It uses Ubuntu, a 15-minute timeout, .nvmrc, npm caching, and clean dependency installation.
Quality and test execution .github/workflows/ci.yml	The workflow runs ESLint, Markdown linting, Prettier checks, unit tests, smoke tests, and API validation tests in sequence.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the CI workflow but omits the required Validation and Checklist sections and leaves key command details incomplete.	Add the required Summary, Validation, and Checklist sections, then complete the command, runner, and Node.js details.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI workflow and its lint, test, and smoke-check coverage.
Linked Issues check	✅ Passed	The workflow covers installation, linting, tests, API smoke checks, pull requests, practical runtime, and clear quality-check status for issue #29.
Out of Scope Changes check	✅ Passed	The pull request changes only the CI workflow, and all listed changes directly support issue #29 objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Line 15: Update the pull_request job in the workflow to configure
actions/checkout with persist-credentials disabled and add job-level contents:
read permissions, ensuring repository-controlled npm commands cannot access
persisted GitHub credentials.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 60d0e016-5d9c-4bae-96da-5f67130b0ae7

📥 Commits

Reviewing files that changed from the base of the PR and between 6eb1d2b and 67e7b19.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -e
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/ci.yml
printf '%s\n' '--- workflow files ---'
git ls-files '.github/workflows/*'
printf '%s\n' '--- checkout and permission settings ---'
rg -n -C 3 'actions/checkout|permissions:|pull_request|npm ci|npm run|setup-node' .github/workflows
printf '%s\n' '--- package scripts and lifecycle hooks ---'
python3 - <<'PY'
import json
from pathlib import Path

p = Path("package.json")
if p.exists():
    data = json.loads(p.read_text())
    scripts = data.get("scripts", {})
    for name, value in scripts.items():
        print(f"{name}: {value}")
    for name in ("preinstall", "install", "postinstall", "prepare"):
        if name in scripts:
            print(f"lifecycle {name}: {scripts[name]}")
else:
    print("package.json: absent")
PY

Repository: Flamki/stellarmind

Length of output: 9504

---

🏁 Script executed:

#!/bin/bash
set -e
python3 - <<'PY'
from pathlib import Path

text = Path(".github/workflows/ci.yml").read_text()
checkout = next((line for line in text.splitlines() if "actions/checkout@" in line), None)
print("checkout:", checkout)
print("persist-credentials explicitly set:", "persist-credentials:" in text)
print("top-level permissions block:", any(line.startswith("permissions:") for line in text.splitlines()))
print("job-level permissions blocks:", any(line.startswith("    permissions:") for line in text.splitlines()))
print("pull_request trigger:", "pull_request:" in text or "pull_request" in text)
print("npm ci present:", "npm ci" in text)
print("npm run present:", "npm run" in text)
PY

Repository: Flamki/stellarmind

Length of output: 383

---

🏁 Script executed:

cat -n .github/workflows/ci.yml

Repository: Flamki/stellarmind

Length of output: 1226

---

Disable persisted GitHub credentials before running pull request code.

The pull_request job runs npm ci and multiple npm run commands, which execute repository-controlled code. Set persist-credentials: false and restrict the job to contents: read.

🧰 Tools

🪛 zizmor (1.29.0)

[warning] 15-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 15, Update the pull_request job in the
workflow to configure actions/checkout with persist-credentials disabled and add
job-level contents: read permissions, ensuring repository-controlled npm
commands cannot access persisted GitHub credentials.

Source: Linters/SAST tools