FLO-161: Harden CI — lint/typecheck/test quality gate on node 22 / yarn 4

[Fl0p]

Summary

Turns CI from build-only into a real quality gate and locks the toolchain to Node 22 (LTS) + Yarn 4 via Corepack.

New workflow .github/workflows/ci.yml runs on push to main and every PR:

yarn install --immutable   # single in-sync lockfile (yarn.lock); no npm
yarn lint                  # ESLint — fails on errors (warnings non-blocking)
yarn typecheck             # tsc --noEmit
yarn test                  # Vitest (117 tests)

Acceptance criteria

• ✅ A PR with a lint error / type error / failing test makes CI red; clean tree is green (each step fails the job on non-zero exit).
• ✅ Node 22 LTS + Yarn 4 via Corepack; no npm invocation anywhere.
• ✅ Single lockfile — package-lock.json already gone (removed in FLO-158), only yarn.lock remains; --immutable enforces sync.
• ✅ DISABLE_ESLINT_PLUGIN fully absent from the repo (grep clean); lint runs as its own step.
• ✅ README documents the CI gate (new "Continuous integration" section).

Verification (local, on clean branch)

• yarn lint → 0 errors, 6 pre-existing warnings (non-blocking by design) → exit 0
• yarn typecheck → exit 0 (skipLibCheck keeps zod v4 node_modules noise out)
• yarn test → 117/117 pass
• yarn install --immutable → exit 0 (lockfile in sync)

GitHub Actions CI run on this PR is the green-on-clean-branch evidence. Failing-case check: each gate is a separate run: step, so a non-zero exit from eslint (error), tsc, or vitest fails the quality-gate job — standard GitHub Actions step semantics.

Design notes (decision lenses)

• Boring tech beats clever tech — Corepack-before-setup-node is the documented, debuggable ordering for Yarn 4 + the cache: yarn step; no custom cache wiring.
• Lint intentionally does not use --max-warnings 0: the 6 warnings are pre-existing and the eslint config explicitly chose not to gate on them. A future ticket can drive warnings to zero and then tighten.

Closes FLO-161.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@Fl0p, we couldn't start this review because you've used your available PR reviews for now.

Your plan currently allows 1 review/hour. Refill in 50 minutes and 38 seconds.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more review capacity refills, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8f10fae8-5dc8-4e24-a1b2-1a6b20abee02

📥 Commits

Reviewing files that changed from the base of the PR and between 04120c6 and 5d02bbc.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• README.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch flo-161-ci-quality-gate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}