CI: GitHub Actions lint + CPU test workflow

Publication plan phase 2.  Two status checks on push/PR: `lint`
(make lint: ruff format --check, ruff check, mypy) and `test`
(make test-ci: full suite with --device cpu).  Both mirror the
Modal test image — CPython 3.12, dev + test-onnx groups from the
standalone uv.lock — and UV_LOCKED makes every sync assert that
lock is current, the same drift check-modal-lock guards.

make test-ci refuses to run outside CI: locally a full-suite run
belongs on Modal, and inside the umbrella workspace `uv sync`
would rewrite the shared venv (exact sync removes opt-in packages
like torchwright_doom's onnxruntime-gpu).

Validated via `make test ARGS="--device cpu"` on Modal before
adding the workflow.

Test Suite Status: 1615 passed, 0 failed, 0 skipped (--device cpu).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: physicsrob

.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # Match the Modal test image (modal_image.py): CPython 3.12, installed
+  # from the standalone torchwright/uv.lock.  UV_LOCKED makes every sync
+  # assert that lock is current (the same drift check-modal-lock guards).
+  UV_PYTHON: "3.12"
+  UV_LOCKED: "1"
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+      - name: Sync dev environment
+        run: uv sync
+      - name: Lint
+        run: make lint
+
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+      - name: Test (CPU)
+        run: make test-ci

Makefile

@@ -60,6 +60,21 @@ test: check-modal-lock
 test-logs:
 	@tail -f /tmp/torchwright-test.log
 
+# CI entry point (.github/workflows/ci.yml): full suite on the runner's CPU,
+# synced from the standalone lock like the Modal image.  Guarded to CI because
+# inside the umbrella workspace `uv sync` operates on the shared venv instead
+# (dropping opt-in packages like torchwright_doom's onnxruntime-gpu), and a
+# full local suite run belongs on Modal anyway (see test-local's guard).
+.PHONY: test-ci
+test-ci:
+	@if [ -z "$$CI" ]; then \
+		echo "Error: test-ci is the CI entry point (runs the full suite locally)." >&2 ; \
+		echo "       Use 'make test' (Modal) or 'make test-local FILE=...' instead." >&2 ; \
+		exit 2 ; \
+	fi
+	uv sync --group test-onnx
+	uv run --no-sync pytest tests --device cpu
+
 .PHONY: test-local
 test-local:
 	@if [ -z "$(FILE)" ]; then \