ci: add prebuild script and CI test pipeline

Add scripts/prebuild.sh that gates releases behind lint, typecheck, and
tests before committing and tagging. Add CI workflow that runs lint,
typecheck, and tests on every push/PR. Add test steps to release workflow
so tagged builds can't publish broken artifacts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Dimitar Fenerski

.github/workflows/ci.yml

@@ -0,0 +1,73 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  lint-and-typecheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Type-check
+        run: npx tsc -b
+
+  test-frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Test
+        run: npm run test
+
+  test-rust:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            patchelf \
+            libssl-dev \
+            libgtk-3-dev
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Rust cache
+        uses: swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri
+
+      - name: Run Rust tests
+        working-directory: src-tauri
+        run: cargo test --lib

.github/workflows/release.yml

@@ -43,6 +43,19 @@ jobs:
       - name: Install frontend dependencies
         run: npm ci
 
+      - name: Lint
+        run: npm run lint
+
+      - name: Type-check
+        run: npx tsc -b
+
+      - name: Frontend tests
+        run: npm run test
+
+      - name: Rust tests
+        working-directory: src-tauri
+        run: cargo test --lib
+
       - name: Build Tauri app
         uses: tauri-apps/tauri-action@v0
         env:

CLAUDE.md

@@ -107,14 +107,25 @@ Panel toggle commands dispatch `CustomEvent` on `window` (e.g. `axiomatic:toggle
 - No component library — all UI is hand-written
 - PDFs rendered via `pdfium://` custom protocol (native PDFium, JPEG output)
 - **Test-before-modify rule**: Before changing any logic, verify it has test coverage. If not, extract into a testable unit and write tests FIRST. This applies to all logic — component wiring, command lists, state assembly — not just leaf components. Tests must assert desired behavior, not mirror current implementation.
+- **Pre-release gate**: Always run `./scripts/prebuild.sh <version>` before pushing a release tag. Never tag manually. The script runs the full lint → typecheck → test pipeline and only tags if everything passes.
 
 ## Commands
 
 ```bash
 npm run dev          # tauri dev (vite + rust)
 npm run build        # tauri build
 npm run vite:dev     # vite only (no tauri)
-npx tsc --noEmit     # type-check
+npx tsc -b           # type-check (same as build uses)
+npm run lint         # eslint
+npm run test         # vitest unit tests
+cargo test --lib     # rust unit tests (from src-tauri/)
+```
+
+## Release workflow
+
+```bash
+./scripts/prebuild.sh <version>   # bump, lint, fix, test, commit, tag
+git push origin master --tags     # push commit + tag → triggers CI release
 ```
 
 ## Known gotchas

scripts/prebuild.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ $# -ne 1 ]; then
+  echo "Usage: $0 <version>"
+  echo "Example: $0 0.1.0"
+  exit 1
+fi
+
+VERSION="$1"
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+echo "=== Prebuild pipeline for v${VERSION} ==="
+echo ""
+
+# 1. Version bump
+echo ">> Bumping version..."
+bash scripts/bump-version.sh "$VERSION"
+echo ""
+
+# 2. ESLint fix
+echo ">> Running ESLint with --fix..."
+npm run lint -- --fix
+echo ""
+
+# 3. Type-check (same as vite:build uses — NOT --noEmit)
+echo ">> Type-checking (tsc -b)..."
+npx tsc -b
+echo ""
+
+# 4. Frontend tests
+echo ">> Running Vitest..."
+npm run test
+echo ""
+
+# 5. Rust check
+echo ">> Running cargo check..."
+(cd src-tauri && cargo check)
+echo ""
+
+# 6. Rust tests
+echo ">> Running cargo test --lib..."
+(cd src-tauri && cargo test --lib)
+echo ""
+
+# 7. Stage, commit, and tag
+echo ">> Committing and tagging..."
+git add -A
+git commit -m "chore: bump version to v${VERSION}"
+git tag "v${VERSION}"
+echo ""
+
+echo "=== Done ==="
+echo "  Commit: chore: bump version to v${VERSION}"
+echo "  Tag:    v${VERSION}"
+echo ""
+echo "Review the commit, then push:"
+echo "  git push origin master --tags"