ci: add mock test workflow for PRs

[AhmedTMM]

Summary

• Adds a GitHub Actions workflow that runs bash test/mock.sh on every PR targeting main
• Includes concurrency grouping to cancel stale CI runs on the same branch
• 10-minute timeout to prevent hung jobs
• Posts test results to the GitHub Actions step summary for quick review

Context

Extracted from #833 as a smaller, focused PR per reviewer feedback.

Test plan

• Workflow file is valid YAML
• bash test/mock.sh runs successfully in CI
• Step summary shows test results

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• None

Analysis

• Workflow uses pull_request trigger (read-only context, no secrets exposed) — safe
• actions/checkout@v4 — standard, acceptable version pinning
• No ${{ }} expression injection in run: blocks — all expressions only in concurrency.group (safe context)
• No secrets referenced — appropriate for test-only workflow
• Test output piped to GITHUB_STEP_SUMMARY is filtered via grep + head -100 — low injection risk
• 10-minute timeout prevents hung jobs
• Concurrency grouping with cancel-in-progress prevents stale CI runs

Tests

• YAML validation: PASS
• bash -n: N/A (no .sh files changed)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: N/A
• macOS compat: N/A

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds a GitHub Actions workflow that runs bash test/mock.sh on every PR targeting main
• Includes concurrency grouping to cancel stale CI runs on the same branch
• 10-minute timeout to prevent hung jobs
• Posts test results to the GitHub Actions step summary for quick review

Context

Extracted from #833 as a smaller, focused PR per reviewer feedback.

Test plan

• Workflow file is valid YAML
• bash test/mock.sh runs successfully in CI
• Step summary shows test results

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• None

Analysis

• Workflow uses pull_request trigger (read-only context, no secrets exposed) — safe
• actions/checkout@v4 — standard, acceptable version pinning
• No ${{ }} expression injection in run: blocks — all expressions only in concurrency.group (safe context)
• No secrets referenced — appropriate for test-only workflow
• Test output piped to GITHUB_STEP_SUMMARY is filtered via grep + head -100 — low injection risk
• 10-minute timeout prevents hung jobs
• Concurrency grouping with cancel-in-progress prevents stale CI runs

Tests

• YAML validation: PASS
• bash -n: N/A (no .sh files changed)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: N/A
• macOS compat: N/A

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds a GitHub Actions workflow that runs bash test/mock.sh on every PR targeting main
• Includes concurrency grouping to cancel stale CI runs on the same branch
• 10-minute timeout to prevent hung jobs
• Posts test results to the GitHub Actions step summary for quick review

Context

Extracted from #833 as a smaller, focused PR per reviewer feedback.

Test plan

• Workflow file is valid YAML
• bash test/mock.sh runs successfully in CI
• Step summary shows test results

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• None

Analysis

• Workflow uses pull_request trigger (read-only context, no secrets exposed) — safe
• actions/checkout@v4 — standard, acceptable version pinning
• No ${{ }} expression injection in run: blocks — all expressions only in concurrency.group (safe context)
• No secrets referenced — appropriate for test-only workflow
• Test output piped to GITHUB_STEP_SUMMARY is filtered via grep + head -100 — low injection risk
• 10-minute timeout prevents hung jobs
• Concurrency grouping with cancel-in-progress prevents stale CI runs

Tests

• YAML validation: PASS
• bash -n: N/A (no .sh files changed)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: N/A
• macOS compat: N/A

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds a GitHub Actions workflow that runs bash test/mock.sh on every PR targeting main
• Includes concurrency grouping to cancel stale CI runs on the same branch
• 10-minute timeout to prevent hung jobs
• Posts test results to the GitHub Actions step summary for quick review

Context

Extracted from #833 as a smaller, focused PR per reviewer feedback.

Test plan

• Workflow file is valid YAML
• bash test/mock.sh runs successfully in CI
• Step summary shows test results

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• None

Analysis

• Workflow uses pull_request trigger (read-only context, no secrets exposed) — safe
• actions/checkout@v4 — standard, acceptable version pinning
• No ${{ }} expression injection in run: blocks — all expressions only in concurrency.group (safe context)
• No secrets referenced — appropriate for test-only workflow
• Test output piped to GITHUB_STEP_SUMMARY is filtered via grep + head -100 — low injection risk
• 10-minute timeout prevents hung jobs
• Concurrency grouping with cancel-in-progress prevents stale CI runs

Tests

• YAML validation: PASS
• bash -n: N/A (no .sh files changed)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: N/A
• macOS compat: N/A

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds a GitHub Actions workflow that runs bash test/mock.sh on every PR targeting main
• Includes concurrency grouping to cancel stale CI runs on the same branch
• 10-minute timeout to prevent hung jobs
• Posts test results to the GitHub Actions step summary for quick review

Context

Extracted from #833 as a smaller, focused PR per reviewer feedback.

Test plan

• Workflow file is valid YAML
• bash test/mock.sh runs successfully in CI
• Step summary shows test results

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• None

Analysis

• Workflow uses pull_request trigger (read-only context, no secrets exposed) — safe
• actions/checkout@v4 — standard, acceptable version pinning
• No ${{ }} expression injection in run: blocks — all expressions only in concurrency.group (safe context)
• No secrets referenced — appropriate for test-only workflow
• Test output piped to GITHUB_STEP_SUMMARY is filtered via grep + head -100 — low injection risk
• 10-minute timeout prevents hung jobs
• Concurrency grouping with cancel-in-progress prevents stale CI runs

Tests

• YAML validation: PASS
• bash -n: N/A (no .sh files changed)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: N/A
• macOS compat: N/A

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds a GitHub Actions workflow that runs bash test/mock.sh on every PR targeting main
• Includes concurrency grouping to cancel stale CI runs on the same branch
• 10-minute timeout to prevent hung jobs
• Posts test results to the GitHub Actions step summary for quick review

Context

Extracted from #833 as a smaller, focused PR per reviewer feedback.

Test plan

• Workflow file is valid YAML
• bash test/mock.sh runs successfully in CI
• Step summary shows test results

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• None

Analysis

• Workflow uses pull_request trigger (read-only context, no secrets exposed) — safe
• actions/checkout@v4 — standard, acceptable version pinning
• No ${{ }} expression injection in run: blocks — all expressions only in concurrency.group (safe context)
• No secrets referenced — appropriate for test-only workflow
• Test output piped to GITHUB_STEP_SUMMARY is filtered via grep + head -100 — low injection risk
• 10-minute timeout prevents hung jobs
• Concurrency grouping with cancel-in-progress prevents stale CI runs

Tests

• YAML validation: PASS
• bash -n: N/A (no .sh files changed)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: N/A
• macOS compat: N/A

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds a GitHub Actions workflow that runs bash test/mock.sh on every PR targeting main
• Includes concurrency grouping to cancel stale CI runs on the same branch
• 10-minute timeout to prevent hung jobs
• Posts test results to the GitHub Actions step summary for quick review

Context

Extracted from #833 as a smaller, focused PR per reviewer feedback.

Test plan

• Workflow file is valid YAML
• bash test/mock.sh runs successfully in CI
• Step summary shows test results

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• None

Analysis

• Workflow uses pull_request trigger (read-only context, no secrets exposed) — safe
• actions/checkout@v4 — standard, acceptable version pinning
• No ${{ }} expression injection in run: blocks — all expressions only in concurrency.group (safe context)
• No secrets referenced — appropriate for test-only workflow
• Test output piped to GITHUB_STEP_SUMMARY is filtered via grep + head -100 — low injection risk
• 10-minute timeout prevents hung jobs
• Concurrency grouping with cancel-in-progress prevents stale CI runs

Tests

• YAML validation: PASS
• bash -n: N/A (no .sh files changed)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: N/A
• macOS compat: N/A

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds a GitHub Actions workflow that runs bash test/mock.sh on every PR targeting main
• Includes concurrency grouping to cancel stale CI runs on the same branch
• 10-minute timeout to prevent hung jobs
• Posts test results to the GitHub Actions step summary for quick review

Context

Extracted from #833 as a smaller, focused PR per reviewer feedback.

Test plan

• Workflow file is valid YAML
• bash test/mock.sh runs successfully in CI
• Step summary shows test results

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• None

Analysis

• Workflow uses pull_request trigger (read-only context, no secrets exposed) — safe
• actions/checkout@v4 — standard, acceptable version pinning
• No ${{ }} expression injection in run: blocks — all expressions only in concurrency.group (safe context)
• No secrets referenced — appropriate for test-only workflow
• Test output piped to GITHUB_STEP_SUMMARY is filtered via grep + head -100 — low injection risk
• 10-minute timeout prevents hung jobs
• Concurrency grouping with cancel-in-progress prevents stale CI runs

Tests

• YAML validation: PASS
• bash -n: N/A (no .sh files changed)
• bun test: N/A (no .ts files changed)
• curl|bash pattern: N/A
• macOS compat: N/A

---

-- security/pr-reviewer