ci(coverage): gate PRs on 100% patch coverage + 95% project floor (#13) #33

	name: CI

	# CI is a MANDATORY gate: the hermetic build + integration suite runs on
	# every push and pull request. A failure blocks the merge. The suite has no
	# network dependency (it drives an in-process mock of the agent API), so it
	# is fully deterministic in CI.
	#
	# Both `main` and `master` are listed: the repo's default branch is `master`,
	# and an earlier revision of this file watched only `main`, which meant CI
	# never actually ran. Listing both is intentional and safe.

	on:
	push:
	branches: [main, master]
	pull_request:
	branches: [main, master]

	jobs:
	build-and-test:
	name: build + integration gate
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-go@v5
	with:
	go-version: '1.23'

	# The local gate (`make ci`) is identical to this CI gate:
	# build -> go build ./...
	# vet -> go vet ./...
	# test -> go test ./... -v -race -count=1 (hermetic + integration)
	- name: build
	run: go build ./...

	- name: vet
	run: go vet ./...

	- name: integration suite (hermetic, mandatory)
	run: go test ./... -v -race -count=1

Provide feedback