ci: validate the build on every push and pull request

Runs mvn verify on push to main and on pull requests, so a broken
build is caught here rather than only when a v* tag fires the publish
pipeline. Uses verify (not test) because the cli integration tests
need the daemon's packaged fat jar.

Author: aksOps

.github/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: CI
+
+# Builds and runs the full test suite on every push and pull request, so a
+# broken build is caught here — before a v* tag fires the publish pipeline.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: maven
+
+      - name: Set up Node.js (JS/TS analyzer tests need a Node runtime)
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Build and test
+        # `verify`, not `test`: the cli integration tests spawn the daemon and
+        # need its shaded fat jar, which is only built at the package phase.
+        run: mvn -B -ntp verify