From fc2067d49568c18c8fa328dd8248230caa9cab2b Mon Sep 17 00:00:00 2001
From: Jen Hamon <jhamon@pinecone.io>
Date: Sat, 11 Jul 2026 16:03:35 -0400
Subject: [PATCH] ci: add phase-1 GitHub Actions workflow (per-app matrix)

The repo had no CI. Adds a workflow running on push/PR to main that,
per sample app, installs deps and runs lint/build (Next.js apps) or
byte-compiles the FastAPI backend (shop-the-look). Matrix covers the
mixed package managers (npm + pnpm) and the client/server split in
namespace-notes.

Jobs are non-blocking (continue-on-error) in this first phase because
some apps have known-broken installs (e.g. legal-semantic-search
`file:` deps, namespace-notes stale `install:all` path) tracked in #73
and SDK drift in #74. Flipping the matrix to a required gate is tracked
in #71 and depends on that cleanup.

Token scoped contents: read (least privilege).

Part of #71.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 93 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 93 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..933efd0
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,93 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+# Least-privilege default token (maintenance issue #71).
+permissions:
+  contents: read
+
+jobs:
+  # Phase 1 (informational): each Next.js app installs + lints + builds.
+  # Jobs are non-blocking (continue-on-error) because some apps have
+  # known-broken installs tracked in #73 (e.g. legal-semantic-search
+  # `file:` deps) and SDK drift in #74. Flipping this matrix to a REQUIRED
+  # gate is tracked in #71 and depends on that cleanup landing.
+  node-apps:
+    name: "node: ${{ matrix.app }}"
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - app: legal-semantic-search
+            pm: npm
+          - app: pinecone-assistant
+            pm: pnpm
+          - app: shop-the-look
+            pm: npm
+    defaults:
+      run:
+        working-directory: ${{ matrix.app }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup pnpm
+        if: matrix.pm == 'pnpm'
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: ${{ matrix.pm }}
+          cache-dependency-path: ${{ matrix.app }}/${{ matrix.pm == 'pnpm' && 'pnpm-lock.yaml' || 'package-lock.json' }}
+      - name: Install
+        run: ${{ matrix.pm == 'pnpm' && 'pnpm install --frozen-lockfile' || 'npm ci' }}
+      - name: Lint
+        run: ${{ matrix.pm == 'pnpm' && 'pnpm run lint' || 'npm run lint' }}
+      - name: Build
+        run: ${{ matrix.pm == 'pnpm' && 'pnpm run build' || 'npm run build' }}
+
+  # namespace-notes is a client + server/node split (no top-level build).
+  namespace-notes:
+    name: "node: namespace-notes (install)"
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      # Installs client and server via their real paths. The repo's own
+      # `install:all` script is broken (it targets `server/node`, but the
+      # dir is `server/`) — that defect is tracked in cleanup issue #73.
+      - name: Install client
+        working-directory: namespace-notes/client
+        run: npm install
+      - name: Install server
+        working-directory: namespace-notes/server
+        run: npm install
+
+  # shop-the-look has a FastAPI backend.
+  python-backend:
+    name: "python: shop-the-look"
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install requirements
+        working-directory: shop-the-look
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+      - name: Byte-compile API
+        working-directory: shop-the-look
+        run: python -m compileall api