[fabianzimber]

Why

The repo only runs CodeQL. Dependency changes therefore merge without ever being compiled, linted, or typechecked.

That is exactly how PR #10 reached main: it bumped react-dom to 19.2.8 while react stayed at 19.2.4, and [email protected] requires peer react@"^19.2.8". Every check stayed green while npm ci failed outright with ERESOLVE and no dependency tree could be resolved at all. It was only caught by running the checks by hand afterwards.

What

Two jobs:

web — on Node 22 (the version pinned in web/Dockerfile), with npm cache keyed on web/package-lock.json:

1. npm ci
2. npm run lint
3. npm run typecheck
4. npm run build

terraform — in infra/terraform/aws on Terraform 1.14.0:

1. terraform fmt -check -recursive
2. terraform init -backend=false
3. terraform validate

Notes on choices:

• npm ci, not npm install — installs exactly what the lockfile pins and fails on an unresolvable tree. This is the check that would have caught chore(deps): bump react-dom and @types/react-dom in /web #10.
• init -backend=false — this repo has no backend and no deployed infrastructure. Validating config only, so the job needs no AWS credentials and cannot reach real AWS APIs.
• TypeScript stays on 5 — tsc --noEmit passes, and typescript-eslint (via eslint-config-next) does not support TS 7 yet, so the lint step would break.
• Concurrency group cancels superseded runs, which matters once Dependabot opens several PRs at once.

Also adds a typecheck script (tsc --noEmit) to web/package.json so the check is identical locally and in CI.

Verification

Check	Result
npm run typecheck	pass
npm run lint	pass
npm run build	pass
terraform fmt -check -recursive	pass
terraform validate	pass
workflow YAML parses	pass (2 jobs: web, terraform)

The GitHub Actions run on this PR is itself the remaining proof — web and terraform should both go green.

Follow-ups after this

• Add ci.yml to branch protection as a required check so it actually gates merges.
• Consider ignoring the typescript 7.x and eslint 10.x Dependabot updates that are blocked upstream (see chore(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /web #11 and chore(deps-dev): bump eslint from 9.39.4 to 10.9.1 in /web #12), so they stop regenerating every week.