From c39d340a17edb212e2917891508be0cccf317090 Mon Sep 17 00:00:00 2001
From: Thierry Heumann <2956045+theumann@users.noreply.github.com>
Date: Mon, 26 Oct 2026 11:24:26 -0700
Subject: [PATCH] Typecheck in GitHub Actions on every PR

The Cloudflare build is the only required check, and `astro build`
doesn't typecheck, so a type error in a component could merge as long as
the site still built. This runs `npm run check` on every PR and push to
main, as a "Typecheck" job the main ruleset can require.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/check.yml | 37 +++++++++++++++++++++++++++++++++++++
 CLAUDE.md                   |  4 ++--
 2 files changed, 39 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/check.yml

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
new file mode 100644
index 0000000..cd95a36
--- /dev/null
+++ b/.github/workflows/check.yml
@@ -0,0 +1,37 @@
+name: Check
+
+# Cloudflare's build is the other required check, but `astro build` doesn't
+# typecheck, so this runs `astro check` on every PR and push to main. The job
+# name, "Typecheck", is what the main ruleset requires: rename it there too.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+# A newer push to the same branch or PR cancels the run still going.
+concurrency:
+  group: check-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  ASTRO_TELEMETRY_DISABLED: 1
+
+jobs:
+  typecheck:
+    name: Typecheck
+    # Pinned rather than ubuntu-latest, so a runner image change never fails
+    # a PR that didn't touch anything.
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npm run check
diff --git a/CLAUDE.md b/CLAUDE.md
index 408b17e..732a126 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -17,7 +17,7 @@ npm run preview     # serve the built site
 npm run check       # typecheck .astro files
 ```
 
-No test suite. No lint script configured.
+No test suite. No lint script configured. `npm run check` also runs in GitHub Actions (`.github/workflows/check.yml`) on every PR and push to `main`, because the Cloudflare build doesn't typecheck.
 
 ## Architecture
 
@@ -53,7 +53,7 @@ No test suite. No lint script configured.
 
 ## Deploy
 
-Cloudflare (Workers → Import a repository, or Pages if that tab still exists). Build command `npm run build`, output directory `dist`. Push to `main` deploys; every push to any other branch builds a preview, PR or not — `https://<branch>.theapps-7nt.pages.dev`, and the "Cloudflare Pages" check on the commit links it. See README.md for the full walkthrough, including custom-domain and email-routing setup.
+Cloudflare (Workers → Import a repository, or Pages if that tab still exists). Build command `npm run build`, output directory `dist`. Push to `main` deploys; every push to any other branch builds a preview, PR or not — `https://<branch>.theapps-7nt.pages.dev`, and the "Cloudflare Pages" check on the commit links it. `main` is protected by a ruleset: changes go through a pull request (no approvals needed), and "Cloudflare Pages" and "Typecheck" must pass before it can merge. Direct pushes and force pushes to `main` are refused. See README.md for the full walkthrough, including custom-domain and email-routing setup.
 
 **The site is live and indexable** as of 2026-09-21. It spent its first weeks online under a `noindex, nofollow` meta so the first impression would be deliberate; that tag is gone and `public/robots.txt` advertises the sitemap again. If it ever needs to go back to being unlisted, use the meta tag rather than `Disallow: /` in robots.txt — a blocked crawler never fetches the page, so it never reads the noindex, and bare URLs can still be indexed from links elsewhere.