ci: run tests, lint, bandit, TUI and viewer checks on pull requests

[itzzdev09]

Refs #1260 — the first slice of it. What's in and what's deferred is spelled out below.

Why

The only workflow is Build & Release, which runs on version tags. Nothing runs the documented checks on a pull request, so a change can merge without them ever running in CI.

What this adds

A Checks workflow on pull requests and pushes to main:

job	runs	mirrors
ruff	ruff check . and ruff format --check .	make lint, without --fix
bandit	bandit -r strix/ -c pyproject.toml	make security
pytest	the suite on 3.12, 3.13 and 3.14	every version pyproject.toml classifies
tui	gofmt -l, go vet, go test -race	make tui-lint, make tui-test
viewer	npm ci and npm run build	make viewer, minus the commit step

Conventions match build-release.yml: every action pinned to a full commit SHA with a version comment, persist-credentials: false on checkout, and read-only permissions. A concurrency group cancels superseded runs on the same branch.

No job changes files, and none is required. That follows the rollout in #1260: land the checks, clear the baseline, then require each check once it's green.

Baseline on main, measured before writing this

I checked what each job reports on current main so the first run holds no surprises:

• ruff: passes. uv run resolves to the ruff pinned in uv.lock (0.15.20), not the older rev in .pre-commit-config.yaml. With that version, ruff check . passes and ruff format --check . reports 226 files already formatted. One thing that tripped me up: a local venv that has drifted to a newer ruff reports errors on main that the pinned version doesn't. CI's uv sync --frozen avoids that.
• bandit: passes. 0 issues, exit 0 (bandit 1.9.4, matching the lock).
• viewer: builds. npm ci && npm run build succeeds, and the output matches the committed static/ assets.
• pytest: one known failure on main, fixed on this branch. tests/test_pricing.py::test_resolves_common_bare_model_names fails on main because of BUG: pricing resolver returns the aggregator route for equally priced models (test failing on main) #1288: LiteLLM's cost map now lists grok-4.5 under xai/, perplexity/xai/ and openrouter/x-ai/ at the same price, and alphabetical order resolved the bare name to OpenRouter. 76267dc sorts matches by path depth first, so the direct provider wins, and all three pytest jobs pass. It overlaps with fix(pricing): prefer the provider's own route when several are equally priced #1289, fix(pricing): prefer a native provider over aggregator re-listings #1279 and test(pricing): make bare-model resolution test deterministic #1215; if one of those merges first, the commit can be dropped from here.
• tui: verified only by this run. I don't have Go locally, so this is the one job I haven't run myself. The commands are copied verbatim from the Makefile targets, and the job pins Go through go-version-file in go.mod.

actionlint 1.7.12 passes on the workflow, and a structural check confirms every uses: is SHA-pinned.

Deliberately deferred

• Type checking. mypy is in ci: type-check every supported platform, and fix what that surfaced #1301 (per-platform), which already passes on all three platforms. Pyright isn't covered yet; it deserves its own baseline.
• Windows and macOS. [FEATURE] Add required test and quality checks for pull requests #1260 suggests them for platform-specific behaviour. Today a Windows test job would be red on the Unix-only assumptions fixed in test: remove Unix-only and developer-specific assumptions from the suite #1297 and the archive bug fixed in fix(cloud): pin selected sources with handle stats so Windows ctime compares like with like #1300, so they're better added once those land.
• Committed viewer output freshness. This job proves the viewer builds, not that static/ matches a fresh build. Whether that should be enforced is a policy call for maintainers.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 4/5

The workflow is safe to merge, but its pytest signal will remain non-actionable until the acknowledged baseline failure is handled, and the type-checking comment should be corrected.

Findings

1.  Known Red Test Baseline ▶
2.  Missing Typecheck Workflow ▶

Fix with agent prompt

### Issue 1
.github/workflows/checks.yml:98
The new matrix runs the full test suite on Python 3.12, 3.13, and 3.14 without excluding or marking `test_resolves_common_bare_model_names`, which the PR identifies as already failing on `main`. Every pull request will therefore receive three failed pytest checks regardless of whether it introduced a regression, making these checks poor regression signals until the known failure is fixed.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

### Issue 2
.github/workflows/checks.yml:7
This comment says type checking lives in `typecheck.yml`, but that workflow is not present in the repository and is only proposed in a separate, unmerged change. This incorrectly tells maintainers that pull requests already receive type-check coverage; please describe it as deferred instead.

```suggestion
# Type checking is deferred to a separate workflow.
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

• The configured environments and commands align with repository metadata and existing Makefile targets.
• The pytest job currently has a known red baseline across all three matrix entries.
• The workflow documentation prematurely refers to a type-check workflow that is not present.

_{Reviews (1) · Last reviewed commit: "ci: run tests, lint, bandit, TUI and vie..."}

[greptile-apps]

Known Red Test Baseline

The new matrix runs the full test suite on Python 3.12, 3.13, and 3.14 without excluding or marking test_resolves_common_bare_model_names, which the PR identifies as already failing on main. Every pull request will therefore receive three failed pytest checks regardless of whether it introduced a regression, making these checks poor regression signals until the known failure is fixed.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/checks.yml
Line: 98

Comment:
**Known Red Test Baseline**

The new matrix runs the full test suite on Python 3.12, 3.13, and 3.14 without excluding or marking `test_resolves_common_bare_model_names`, which the PR identifies as already failing on `main`. Every pull request will therefore receive three failed pytest checks regardless of whether it introduced a regression, making these checks poor regression signals until the known failure is fixed.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Missing Typecheck Workflow

This comment says type checking lives in typecheck.yml, but that workflow is not present in the repository and is only proposed in a separate, unmerged change. This incorrectly tells maintainers that pull requests already receive type-check coverage; please describe it as deferred instead.

Suggested change

	# Type checking lives in typecheck.yml, which runs mypy per platform.
	# Type checking is deferred to a separate workflow.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/checks.yml
Line: 7

Comment:
**Missing Typecheck Workflow**

This comment says type checking lives in `typecheck.yml`, but that workflow is not present in the repository and is only proposed in a separate, unmerged change. This incorrectly tells maintainers that pull requests already receive type-check coverage; please describe it as deferred instead.

```suggestion
# Type checking is deferred to a separate workflow.
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[itzzdev09]

First CI run is in, and it matches the baseline in the description:

job	result
ruff	✅
bandit	✅
tui (gofmt, vet, go test -race)	✅
viewer build	✅
pytest (python 3.12)	❌ 1 failed, 1752 passed
pytest (python 3.13)	❌ 1 failed, 1752 passed
pytest (python 3.14)	❌ 1 failed, 1752 passed

The single pytest failure is the same test on all three versions, and it's the known one:

FAILED tests/test_pricing.py::test_resolves_common_bare_model_names
  AssertionError: assert 'openrouter/x-ai/grok-4.5' == 'xai/grok-4.5'

That's #1288. No other test fails on Linux on any supported Python, so once #1289, #1279 or #1215 lands, all five jobs should be green and ready to mark required.

Two things this run confirmed that I could only argue before:

• TUI was the one job I couldn't run locally (no Go toolchain), and it passes.
• 3.14 syncs cleanly from the frozen lockfile and runs the full suite, so the matrix covers every classified version.

[itzzdev09]

Thanks — both are fair points.

Missing typecheck workflow — fixed in 1b8835a. The comment said type checking lives in typecheck.yml, but that only exists in #1301, which isn't merged. It now says type checking isn't covered here and points at #1301.

Known red baseline — correction. I wrote that I was leaving it red, but that was out of date: 76267dc on this branch already fixes the cause of test_resolves_common_bare_model_names (#1288). LiteLLM lists grok-4.5 under xai/, perplexity/xai/ and openrouter/x-ai/ at the same price, and alphabetical order picked OpenRouter; matches are now sorted by path depth first, so the direct provider wins. With it, all eight checks pass, pytest included on 3.12, 3.13 and 3.14. It overlaps with #1289 / #1279 / #1215, so if one of those lands first this commit can be dropped.