chore: add CI workflow and SECURITY.md

[donny-devops]

Adds CI workflow pinned to Node 20 and SECURITY.md.

[qodo-code-review]

Qodo is busy working

Check back in a few minutes. Qodo's code review agents are on it.

[gemini-code-assist]

Code Review

This pull request introduces a SECURITY.md file to outline the project's security policy, specifying supported versions and the process for reporting vulnerabilities. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[qodo-code-review]

PR Summary by Qodo

Add GitHub Actions CI (Node 20) and SECURITY.md policy

⚙️ Configuration changes 📝 Documentation 🕐 10-20 Minutes

AI Description

• Add GitHub Actions CI workflow for build and test on pushes/PRs to main.
• Pin CI runtime to Node.js 20 and use npm caching for faster installs.
• Document a security policy and vulnerability reporting process via SECURITY.md.

Diagram

graph TD
  A["GitHub push/PR"] --> B["CI workflow"] --> C["Ubuntu runner"] --> D["Checkout code"] --> E["Setup Node 20"] --> F["npm ci"] --> G["npm run build"] --> H["npm test"]

  subgraph Legend
    direction LR
    _evt(["Event"]) ~~~ _wf["Workflow"] ~~~ _job["Job/Step"]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use a Node version matrix

• ➕ Catches compatibility issues across multiple Node LTS versions (e.g., 20 and 22).
• ➕ Provides early warning when dependencies break on newer runtimes.
• ➖ Longer CI duration and more compute usage.
• ➖ May require conditional logic if the project intentionally supports only Node 20.

2. Add lint/typecheck as separate CI steps

• ➕ Fails faster on style/type errors before running full tests.
• ➕ Improves signal quality for PRs by enforcing standards consistently.
• ➖ Requires lint/typecheck scripts to exist and be maintained.
• ➖ May add noise if the repository isn’t ready for strict checks.

3. Adopt a reusable workflow template

• ➕ Centralizes CI logic across repos and reduces duplication.
• ➕ Easier to roll out CI improvements consistently.
• ➖ Adds indirection; harder to understand CI by reading this repo alone.
• ➖ Not worth it if this is a single-repo setup.

Recommendation: The current approach is appropriate for a first-pass CI and security policy: it’s minimal, clear, and uses standard actions with Node 20 pinning. Consider a Node version matrix only if you explicitly support multiple runtimes, and add lint/typecheck steps once the repo has stable scripts for them.

Files changed (2) +33 / -0

Documentation (1) +12 / -0

SECURITY.mdDocument supported versions and vulnerability reporting process +12/-0

Document supported versions and vulnerability reporting process

• Adds a SECURITY.md policy describing supported versions (main) and instructing reporters to use GitHub Security Advisories instead of public issues.

SECURITY.md

Other (1) +21 / -0

ci.ymlAdd GitHub Actions CI for npm install, build, and tests (Node 20) +21/-0

Add GitHub Actions CI for npm install, build, and tests (Node 20)

• Introduces a CI workflow triggered on push and pull_request to main. The job runs on ubuntu-latest, checks out the repo, sets up Node.js 20.x with npm caching, then runs npm ci, npm run build, and npm test.

.github/workflows/ci.yml

[amazon-q-developer]

Summary

This PR adds CI workflow and security documentation. Found one configuration issue that needs clarification:

Critical Issue:

• SECURITY.md lacks specific instructions on accessing the security advisory feature

The CI workflow configuration is functional, though the repository currently has no test files. Consider adding tests in future PRs to make the test step meaningful.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[Copilot]

Pull request overview

Adds baseline repository hygiene for security and automation by introducing a Security Policy document and a GitHub Actions CI workflow targeting Node.js 20.

Changes:

• Add SECURITY.md outlining supported versions and a vulnerability reporting channel.
• Add a CI workflow that installs dependencies, builds, and runs tests on pushes/PRs to main.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
SECURITY.md	Introduces a Security Policy with supported versions and vulnerability reporting guidance.
.github/workflows/ci.yml	Adds a Node 20 CI pipeline that installs deps, builds, and runs tests on main push/PR.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 458fea8047

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[donny-devops]

Resolving review threads: CI test step will be addressed separately; SECURITY.md updated intentionally.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donny-devops]

Closing as part of a portfolio-wide open-PR backlog cleanup to present a clean, reviewer-friendly repository. This action is fully reversible — reopen anytime if the work is still needed. (Dependabot PRs will be re-created on the next scan if still applicable.)