ci: add code-quality workflow for required status checks

[don-petry]

Summary

• Adds .github/workflows/code-quality.yml with four jobs: Type check, Lint, Format check, and Tests
• These are the status check contexts required by the code-quality repository ruleset per the standard
• Runs on PRs and pushes to main

Remaining manual step

After merging, create the code-quality repository ruleset requiring these status checks to pass. Run the following with a token that has administration:write:

gh api repos/petry-projects/TalkTerm/rulesets --method POST \
  --header "Accept: application/vnd.github+json" \
  --input /tmp/ruleset.json

Where /tmp/ruleset.json contains the ruleset definition from the previous Claude comment.

Closes #46

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 4 minutes and 17 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 4 minutes and 17 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b3124831-c6cf-4674-9e31-78cda1843881

📥 Commits

Reviewing files that changed from the base of the PR and between 63cdca3 and 7480c17.

📒 Files selected for processing (1)

• .github/workflows/code-quality.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-46-20260407-1733

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

@don-petry — this PR is ready for your review.

It adds the .github/workflows/code-quality.yml workflow that provides the four status check jobs (Type check, Lint, Format check, Tests) required by the code-quality repository ruleset.

One manual step remains after merge: create the repository ruleset via GitHub API or Settings UI (requires administration: write, which the Claude App doesn't have). The full command is in the issue comment.

[sonarqubecloud]

Quality Gate failed

Failed conditions
4 Security Hotspots

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Adds a new GitHub Actions workflow to provide the required code-quality status check contexts (Type check, Lint, Format check, Tests) on PRs and pushes to main, addressing the compliance finding in #46.

Changes:

• Introduces .github/workflows/code-quality.yml with four separate jobs: typecheck, lint, format check, and tests
• Configures the workflow to run on pull_request and push events targeting main

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

npm ci requires a package-lock.json (or other npm lockfile) to exist; this repository currently has no package-lock.json, so this step will fail and make the required status check permanently red. Either commit the lockfile(s) or change the workflow to (a) detect the Node project/lockfile and skip cleanly when absent, or (b) use npm install until a lockfile is added.

[Copilot]

Same issue as above: npm ci will fail without a package-lock.json, and the repo currently doesn't contain one. This will break the Lint required check unless you add a lockfile or make the job conditional / switch to npm install.

[Copilot]

npm run format -- --check relies on the format script being compatible with --check. In this repo's documented conventions, npm run format maps to prettier --write ., so appending --check will run Prettier with both --write and --check and fail. Prefer running prettier --check . directly (or add a dedicated format:check script) for CI.

[Copilot]

Same issue as above: npm ci will fail without a package-lock.json (none exists in the repo today), which will break the Tests required check. Either commit the lockfile or make the job conditional / switch to npm install.

[Copilot]

npm ci will fail without a package-lock.json (none exists in the repo today), so this job will fail immediately and keep the required check red. Either commit the lockfile(s) or make the job conditional / switch to npm install until a lockfile is added.

[don-petry]

Closing as stale — predates the standards PR.

This PR was generated by Claude during the original bulk-toggle yesterday, before petry-projects/.github#86 landed. That standards PR added prompt rules that:

• Require copying from petry-projects/.github/standards/workflows/ verbatim instead of writing workflow files from scratch
• Require verifying SHAs via gh api instead of guessing
• Require the CodeQL actions ecosystem in the matrix where applicable
• Allow gh api and gh label create for admin operations

Re-toggling the underlying issue will let Claude regenerate this fix using the new rules. The next run should produce a workflow that is byte-identical to the standard template (verified with the canary on TalkTerm#51 → PR #78 yesterday).