diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 04b7f63..11822eb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,32 +1,26 @@
 name: CI / build
 
 on:
-  push:
-    branches: [ main ]
   pull_request:
+  push:
     branches: [ main ]
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   build:
-    name: build (${{ matrix.python-version }})
+    name: build (${{ matrix.python }})
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        python-version: [ "3.11", "3.12" ]
+        python: ["3.11", "3.12"]
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Setup Python
-        uses: actions/setup-python@v5
+      - uses: actions/setup-python@v5
         with:
-          python-version: ${{ matrix.python-version }}
+          python-version: ${{ matrix.python }}
 
       - name: Upgrade pip
         run: python -m pip install --upgrade pip
@@ -35,7 +29,7 @@ jobs:
         run: pip install poetry
 
       - name: Install dependencies
-        run: poetry install --no-interaction
+        run: poetry install --with dev --no-interaction
 
       - name: Ruff
         run: poetry run ruff check .
@@ -44,23 +38,22 @@ jobs:
         run: poetry run black --check .
 
       - name: Pytest
-        env:
-          PYTHONPATH: src
-        run: poetry run pytest -q
+        run: PYTHONPATH=src poetry run pytest -q
 
       - name: Mypy
         run: poetry run mypy src
 
-      - name: Package & smoke-test CLI
+      - name: Generate sample report
         run: |
-          poetry build
-          poetry run python -m pip install .
-          mkdir -p _intel
-          diff-risk examples/sample_apv.json -f md -o _intel/report.md
+          mkdir -p examples
+          [[ -f examples/sample_apv.json ]] || printf '{"findings":[]}\n' > examples/sample_apv.json
+          poetry run diff-risk examples/sample_apv.json -f md -o report.md
 
       - name: Upload sample report
         if: always()
         uses: actions/upload-artifact@v4
         with:
           name: sample-report
-          path: _intel/report.md
+          path: |
+            report.md
+          if-no-files-found: ignore
diff --git a/poetry.lock b/poetry.lock
index 468efb5..d647e30 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -510,4 +510,4 @@ typing-extensions = ">=4.12.0"
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.11,<3.13"
-content-hash = "2b48ce546bbd1f272aa423d106192e13f6bf2e71cfad83281e512c9005ac76e3"
+content-hash = "7322727d3aa348f07e3eff8364ab01e118b68507e5229edd6e7fbb03184c82e8"
diff --git a/pyproject.toml b/pyproject.toml
index 476044f..740961d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -15,7 +15,7 @@ rich = "^13"
 
 [tool.poetry.group.dev.dependencies]
 pytest = "^8"
-ruff = "^0.6"
+ruff = "0.6.9"
 black = "^24.8"
 mypy = "^1.11"
 
diff --git a/pyproject.toml.__fixed b/pyproject.toml.__fixed
new file mode 100644
index 0000000..e69de29
diff --git a/report.md b/report.md
new file mode 100644
index 0000000..5d105c8
--- /dev/null
+++ b/report.md
@@ -0,0 +1,5 @@
+# Diff Risk Dashboard 🟢 — No findings
+
+> ✅ No findings detected (all severities are 0).
+
+> Generated by diff-risk-dashboard CLI
diff --git a/src/diff_risk_dashboard/cli.py b/src/diff_risk_dashboard/cli.py
index 69ce753..0c160aa 100644
--- a/src/diff_risk_dashboard/cli.py
+++ b/src/diff_risk_dashboard/cli.py
@@ -87,7 +87,7 @@ def bar(n: int) -> str:
         w = max(1, round(n / maxc * bar_w))
         return "█" * w
 
-    title = Text.assemble(
+    title = Text.assemble(  # type: ignore[arg-type]
         ("Diff Risk Dashboard ", "bold"),
         (emoji + " ",),
         ("— Worst: ", "dim"),