Add PR validation workflow

[AnaBerg]

Summary

Adds a GitHub Actions workflow for pull request validation.

The workflow runs on pull requests and pushes to main, installs dependencies with Bun using the frozen lockfile, then runs linting, type checking, tests, and a production build. It also provides a placeholder DATABASE_URL because the project validates that environment variable during checks even when the validation does not connect to Postgres.

Validation

• DATABASE_URL=postgres://shareable_docs:shareable_docs@localhost:5432/shareable_docs bun run lint
• DATABASE_URL=postgres://shareable_docs:shareable_docs@localhost:5432/shareable_docs bun run typecheck
• DATABASE_URL=postgres://shareable_docs:shareable_docs@localhost:5432/shareable_docs bun run test
• DATABASE_URL=postgres://shareable_docs:shareable_docs@localhost:5432/shareable_docs bun run build

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
shareable-docs	Ready	Preview, Comment	Jun 12, 2026 6:39pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 64f935a7-1733-4552-b772-b0cd40e4d26a

📥 Commits

Reviewing files that changed from the base of the PR and between 9ad9db4 and 7d4e3a5.

📒 Files selected for processing (1)

• .github/workflows/pr-validation.yml

📜 Recent review details

🔇 Additional comments (3)

.github/workflows/pr-validation.yml (3)

9-10: LGTM!

---

27-29: LGTM!

---

32-34: LGTM!

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Added an automated CI validation workflow that runs on pull requests and pushes to main to enforce linting, type checking, testing, and build verification; includes concurrency handling and a job timeout to keep validations timely.

Walkthrough

A new GitHub Actions workflow (.github/workflows/pr-validation.yml) triggers on pull requests and pushes to main, configures concurrency and read-only contents permission, sets DATABASE_URL, and runs Bun-based lint, typecheck, test, and build steps.

Changes

PR Validation Workflow

Layer / File(s)	Summary
CI validation pipeline .github/workflows/pr-validation.yml	Workflow triggers on pull_request and push to main with concurrency cancellation and contents: read permission. The validate job runs on ubuntu-latest (15m timeout), sets DATABASE_URL, checks out the repo, installs Bun v1.3.13, runs bun install --frozen-lockfile, then bun run lint, bun run typecheck, bun run test, and bun run build.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 A tiny workflow hops into place,
On PRs and main it keeps the pace,
Bun installs, then lint and test,
Typechecks, builds — it does its best. 🥕

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Add PR validation workflow' directly and concisely summarizes the main change—adding a GitHub Actions workflow for PR validation.
Description check	✅ Passed	The description provides relevant context about the workflow's purpose, execution triggers, dependencies setup, and validation commands—all directly related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/pr-validation

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/pr-validation.yml:
- Around line 1-13: The workflow currently relies on broader defaults; add a
top-level read-only permissions block (for example: permissions: contents: read)
to tighten the token scope and in the actions/checkout step set
persist-credentials: false to avoid leaking the GITHUB_TOKEN to checked-out
actions; update the job steps that call actions/checkout to include
persist-credentials: false and ensure the new permissions block is present near
the top-level keys (name/on/concurrency) so the workflow uses the reduced token
scope.
- Around line 23-29: The workflow uses mutable refs: actions/checkout@v4,
oven-sh/setup-bun@v2, and bun-version: latest; replace these with immutable pins
by updating the uses entries to the specific commit SHAs (or exact release tags
with known SHAs) for actions/checkout and oven-sh/setup-bun, and set bun-version
to a fixed version string (e.g., "1.0.0" or a specific release like "v1.2.3")
instead of "latest"; edit the lines referencing actions/checkout@v4,
oven-sh/setup-bun@v2, and bun-version: latest accordingly so the workflow always
uses the fixed, immutable refs.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 826a57b6-84e2-4288-bb08-75d334aa2ba2

📥 Commits

Reviewing files that changed from the base of the PR and between 372e1e4 and 9ad9db4.

📒 Files selected for processing (1)

• .github/workflows/pr-validation.yml

📜 Review details

🧰 Additional context used

🪛 Checkov (3.2.530)

.github/workflows/pr-validation.yml

[medium] 20-21: Basic Auth Credentials

(CKV_SECRET_4)

🪛 zizmor (1.25.2)

.github/workflows/pr-validation.yml

[warning] 23-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[warning] 1-45: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

---

[error] 24-24: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)