From 8a7e7cfd45493484f070fb228ce22f879447cd24 Mon Sep 17 00:00:00 2001
From: Kam <erkamyaman35@gmail.com>
Date: Mon, 21 Sep 2026 19:56:16 +0300
Subject: [PATCH 1/2] ci: add workflow for tests and builds

Runs on push and pull requests to main: frozen-lockfile install, then
the test suite, the devtools UI build, the SSR app build, the Chrome
extension build, and a CLI smoke test.
---
 .github/workflows/ci.yml | 41 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..58aa55e
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,41 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: pnpm/action-setup@v5
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Test
+        run: pnpm test
+
+      - name: Build devtools UI
+        run: pnpm devtools:build
+
+      - name: Build Angular host app (SSR)
+        run: pnpm build
+
+      - name: Build Chrome extension
+        run: pnpm extension:build
+
+      - name: Smoke-test the CLI
+        run: node bin.mjs --help

From 46cc2201970ace51362b0dd4508f7310ac0a353b Mon Sep 17 00:00:00 2001
From: Kam <erkamyaman35@gmail.com>
Date: Mon, 21 Sep 2026 20:33:35 +0300
Subject: [PATCH 2/2] ci: restrict workflow token to read-only contents

---
 .github/workflows/ci.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 58aa55e..2fc3db5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true