ci: add Node CI workflow

[Snuffy2]

Summary

Adds a standalone read-only Node CI workflow for ShellPort pull requests and main pushes.

What Changed

• Added ci.yml for pull request, main push, and manual runs.
• Sets up Go from go.mod and Node.js 24 with npm caching.
• Runs npm ci, npm run lint, and npm test.
• Keeps repository permissions read-only and release workflow semantics separate.

Why

ShellPort's package scripts already define the frontend lint and combined frontend/Go test path. Running them in an independent CI gate makes those checks consistent for pull requests and main while provisioning the Go toolchain required by npm test.

Validation

• npm ci
• npm run lint — passed with one existing unused-variable warning.
• npm test — 38 Vitest files / 237 tests passed; all Go race tests passed.
• prek run --files .github/workflows/ci.yml — passed, including YAML and actionlint.
• Static workflow contract passed, including Node 24, Go setup, read-only permissions, and release separation.
• git diff --check passed.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 87a1146d-476f-489d-bfd5-ea318fa7ac46

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

Adds a standalone Node CI workflow that:

• Runs for pull requests, pushes to main, and manual dispatches.
• Provisions the repository-declared Go toolchain and Node.js 24.
• Installs dependencies, runs frontend linting, and executes the combined frontend/Go test suite.
• Uses read-only repository permissions and per-ref cancellation of superseded runs.

Confidence Score: 4/5

The workflow appears safe to merge, with non-blocking supply-chain hardening recommended for its action references.

The workflow’s triggers, permissions, concurrency grouping, toolchain setup, and package scripts align with repository requirements; the only accepted concern is that mutable action tags permit upstream revision changes without a repository diff.

Files Needing Attention: .github/workflows/ci.yml

Security Review

The workflow uses mutable major-version tags for all referenced GitHub Actions. Pinning these actions to full commit SHAs would prevent silently moved tags from changing the code executed by CI.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Adds appropriately scoped Node/Go CI coverage, with the remaining non-blocking concern that action dependencies are referenced through mutable major tags.

Prompt To Fix All With AI

### Issue 1
.github/workflows/ci.yml:23
**Mutable Action References**

The new workflow references `actions/checkout`, `actions/setup-go`, and `actions/setup-node` through mutable `@v7` tags. If an upstream tag is moved or its publishing account is compromised, unreviewed code will execute in every CI run. Pinning each action to a full commit SHA would make the executed revisions immutable.

**How this was verified:** All three changed `uses` entries resolve through mutable major-version tags and execute on the runner before repository checks.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "ci: add Node CI workflow" | Re-trigger Greptile}