feat: CI gate: make the existing CI workflow actually run tests and

[andrei-hasna]

Objective

CI gate: make the existing CI workflow actually run tests and typecheck in domains [loop-infinity-300pr]

REPO: https://github.com/hasna/domains

WHAT TO CHANGE
This repo already has only a .github/workflows/deploy.yml, but no workflow step runs the test suite or the type-checker. CI is passing on PRs without ever executing bun test, which means the signal is decorative.

Add the missing steps to the existing workflow (or add a ci.yml if only a deploy workflow exists) so that pull requests are actually gated.

DONE LOOKS LIKE

• The PR-triggered workflow runs bun install --frozen-lockfile, then bun run typecheck (if the repo defines that script), then bun test.
• If the only existing workflow is deploy-oriented, do not bolt tests onto the deploy job — add a separate ci.yml triggered on pull_request and on push to the default branch, and leave the deploy workflow alone.
• The workflow must actually be green on this PR. If the existing suite fails on a clean checkout, that is the finding — fix the smallest thing that makes it pass, or scope the job to the hermetic subset and state plainly in the PR body which suites were excluded and why. Do NOT use continue-on-error, || true, or test skipping to manufacture green.
• No production source changed beyond what is needed to make the gate honest.

VERIFY

• The workflow run on this PR is green in GitHub Actions.
• bun install --frozen-lockfile && bun test reproduces the same result locally.

EVIDENCE
Checked 2026-07-29 against GitHub HEAD: the .github/workflows contents were fetched through the GitHub API and grepped for test and typecheck invocations. Observed state: only a .github/workflows/deploy.yml. If CI has since been added or extended upstream, close this task as already-done with a one-line comment rather than opening an empty PR.

PROCESS: work in a branch off the default branch, one focused change, conventional commit, open a PR. Do not bundle unrelated cleanups. If the repo has a CHANGELOG, add an entry.

Verification

• policy source: base 04992bb (immutable commit — agent-proof)
• ⚠️ GATE-INTEGRITY: agent touched verify-bearing config — REVIEW (.github/workflows/ci.yml)
• containment: env — allowlist env, non-login shell, run-scoped HOME (registry auth seeded for install)
• install: pass
• typecheck: pass
• build: pass
• test: pass
• doctor (ci): ok — 11 checks passed (1 advisory)

---

Run run_67986a694b44 · backend codewith · task 3e220439-aa3d-467e-8dd0-f57ccdb83074
🏭 Generated by @hasnaxyz/factory

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

Closing. The workflow in this PR is correct — the repo is not ready for it.

Verified on run 30460064498 (job 90603490735): checkout, setup-bun, bun install --frozen-lockfile and bun run typecheck all pass. bun test fails on three tests in src/db/monitoring.test.ts under 'Bulk Domain Check':

checkAllDomains returns empty array when no domains [61366.65ms]
checkAllDomains returns structured results [6033.15ms]
checkAllDomains whois result structure [5995.36ms]

checkAllDomains() performs live whois, SSL and DNS lookups. A GitHub runner cannot reach those, so the calls hang until they time out — which is why a test whose own name says it expects an empty array burned 61 seconds. These are integration tests in unit-test clothing, and no CI workflow can make them pass.

Merging this would have installed a gate that is red on main from the first commit. We already have one permanently-failing gate on this fleet (@hasna/projects prepublishOnly, which can never pass and has trained everyone to publish with --ignore-scripts); a second one would do the same damage here. A gate people learn to ignore is worse than no gate.

Tracked as todos OPE56-00003 with the exact remedy: inject the resolver/whois client so the default run uses a fake and the live path is opt-in, OR tag these as integration tests and exclude them from the default bun test. Not by raising timeouts — the network is absent, not slow.

Re-open a CI workflow PR once bun test is green from a clean clone with no network egress. The workflow file in this PR can be reused as-is.