From 3ba123d2b38fa3fb137dddde779711d01a945575 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Pierzcha=C5=82a?= <thymikee@gmail.com>
Date: Wed, 14 Oct 2026 14:03:50 +0200
Subject: [PATCH 1/3] ci: run checks and tests on every pull request

---
 .github/workflows/ci.yml | 36 ++++++++++++++++++++++++++++++++++++
 CONTRIBUTING.md          |  3 +++
 2 files changed, 39 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..bff824b
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Node ${{ matrix.node }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        # The engines floor, the active LTS and the current release.
+        node: [22, 24, 26]
+        include:
+          - os: macos-latest
+            node: 24
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - run: npm ci
+      - run: npm run check
+      - run: npm test
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 2dde1ee..8e9f3d2 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -29,6 +29,9 @@ npm run check     # syntax checks, build
 npm pack --dry-run
 ```
 
+CI runs `npm run check` and `npm test` on every pull request and push to `main`, on Linux with
+Node 22, 24 and 26 and on macOS with Node 24 (`.github/workflows/ci.yml`).
+
 Tests create a temporary `HOME`, fake credentials and a temporary state directory, so they never
 touch your assistants' settings. One test asserts the published bundle imports nothing but `node:*`,
 which is the point of bundling: `tsdown` inlines `@clack/prompts`, `jsonc-parser` and `smol-toml`

From b1cb64defb3db9bf136baadb1d06c986f88b2b6c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Pierzcha=C5=82a?= <thymikee@gmail.com>
Date: Wed, 14 Oct 2026 14:11:02 +0200
Subject: [PATCH 2/3] ci: run on Linux with the latest Node.js only

---
 .github/workflows/ci.yml | 14 ++------------
 CONTRIBUTING.md          |  2 +-
 2 files changed, 3 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bff824b..237e5bf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,22 +14,12 @@ permissions:
 
 jobs:
   test:
-    name: Node ${{ matrix.node }} on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest]
-        # The engines floor, the active LTS and the current release.
-        node: [22, 24, 26]
-        include:
-          - os: macos-latest
-            node: 24
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: ${{ matrix.node }}
+          node-version: latest
           cache: npm
       - run: npm ci
       - run: npm run check
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 8e9f3d2..e82b499 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -30,7 +30,7 @@ npm pack --dry-run
 ```
 
 CI runs `npm run check` and `npm test` on every pull request and push to `main`, on Linux with
-Node 22, 24 and 26 and on macOS with Node 24 (`.github/workflows/ci.yml`).
+the latest Node.js (`.github/workflows/ci.yml`).
 
 Tests create a temporary `HOME`, fake credentials and a temporary state directory, so they never
 touch your assistants' settings. One test asserts the published bundle imports nothing but `node:*`,

From f4b80316177418726561a5f52105dd116c7f3df5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Pierzcha=C5=82a?= <thymikee@gmail.com>
Date: Wed, 14 Oct 2026 14:11:55 +0200
Subject: [PATCH 3/3] ci: pin actions to commit SHAs

---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 237e5bf..e9d478b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,8 +16,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: latest
           cache: npm