Simple github action

[RawToast]

Summary by CodeRabbit

• Tests

  • Added automated CI workflow that runs on all pushes and pull requests, verifying TypeScript compilation and executing the full test suite automatically.

• Chores

  • Updated build scripts and tooling: replaced typecheck with compile script, added parallel check script, and upgraded TypeScript and Bun type definitions.

[coderabbitai]

Warning

Review limit reached

@RawToast, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 29 minutes and 18 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: cf1b154b-5dc5-4813-886b-e43d71a23a7a

📥 Commits

Reviewing files that changed from the base of the PR and between 1cb0208 and 36aa0d1.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

📝 Walkthrough

Walkthrough

Adds a GitHub Actions CI workflow that runs on master pushes and pull requests. Renames the typecheck script to compile, adds a parallel check script, upgrades TypeScript to 7.0.1-rc and @types/bun to 1.3.14, fixes a whitespace style in bunfig.toml, and introduces a SpawnedProcess type alias in server.ts.

Changes

CI Setup and Tooling

Layer / File(s)	Summary
Scripts, dependencies, and config cleanup package.json, bunfig.toml, server.ts	Renames typecheck to compile (tsc --noEmit), adds a check script running compile and oxfmt in parallel, upgrades @types/bun to 1.3.14 and typescript to 7.0.1-rc, fixes bunfig.toml whitespace around exact = true, and adds a SpawnedProcess type alias in server.ts.
GitHub Actions CI workflow .github/workflows/ci.yml	New workflow triggered on pushes to master and all pull requests; runs bun ci, bun compile, and bun run test on ubuntu-latest.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~4 minutes

Poem

🐰 A bunny CI hops into place,
With compile replacing typecheck's old trace,
TypeScript jumps higher, version RC new,
The workflow runs tests all shiny and true,
No bugs shall escape this vigilant hare! 🎉

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title 'Simple github action' is vague and doesn't clearly convey the main changes in the pull request, which include CI workflow setup, dependency updates, and code refinements.	Revise the title to be more specific about the primary change, such as 'Add GitHub Actions CI workflow' or 'Set up CI with GitHub Actions' to better reflect the main objective.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch tidy-up

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (2)

.github/workflows/ci.yml (2)

12-12: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Consider setting persist-credentials: false for security hardening.

The static analysis tool flagged that credentials may persist through GitHub Actions artifacts. Setting persist-credentials: false prevents the workflow's GitHub token from being available to subsequent steps, reducing the attack surface if the workflow is compromised.

🔒 Suggested security hardening

-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 12, The `actions/checkout` action in the
workflow does not have security hardening configured. Add the
`persist-credentials: false` parameter to the checkout action to prevent the
GitHub token from persisting in subsequent workflow steps. This reduces the
attack surface by ensuring credentials are not available to later steps if the
workflow is compromised. Apply this configuration to the existing checkout
action reference.

Source: Linters/SAST tools

---

14-16: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Pin Bun to a specific version for reproducible builds.

Using bun-version: latest means CI runs may use different Bun versions over time, reducing reproducibility and potentially introducing unexpected failures when Bun releases breaking changes.

📌 Suggested fix: pin to a specific version

       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2
         with:
-          bun-version: latest
+          bun-version: 1.1.36

Check Bun releases for the latest stable version.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 14 - 16, The bun-version parameter in
the setup-bun action is set to "latest", which causes non-reproducible builds as
different CI runs may use different Bun versions. Replace the bun-version value
from "latest" with a specific stable version number (e.g., "1.0.0" or similar)
by checking the Bun releases on GitHub to determine the appropriate stable
version to pin.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Around line 30-32: The CI workflow in .github/workflows/ci.yml is not using
the new check script defined in package.json. Update the CI workflow step that
currently runs bun compile to instead run bun run check, which will execute both
compilation and format checking in parallel, ensuring that formatting violations
are caught during CI runs.
- Line 40: The typescript dependency in package.json is currently set to version
7.0.1-rc, which is a pre-release candidate version. Update the typescript
version to use a stable release instead of the RC version. If a stable version
7.0.1 or later is available, use that specific stable version number. If you
need to use the latest stable TypeScript version available, update to the
appropriate stable release number that meets your project requirements.

---

Nitpick comments:
In @.github/workflows/ci.yml:
- Line 12: The `actions/checkout` action in the workflow does not have security
hardening configured. Add the `persist-credentials: false` parameter to the
checkout action to prevent the GitHub token from persisting in subsequent
workflow steps. This reduces the attack surface by ensuring credentials are not
available to later steps if the workflow is compromised. Apply this
configuration to the existing checkout action reference.
- Around line 14-16: The bun-version parameter in the setup-bun action is set to
"latest", which causes non-reproducible builds as different CI runs may use
different Bun versions. Replace the bun-version value from "latest" with a
specific stable version number (e.g., "1.0.0" or similar) by checking the Bun
releases on GitHub to determine the appropriate stable version to pin.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bcd54552-26f4-4651-98e5-cb2e26882e61

📥 Commits

Reviewing files that changed from the base of the PR and between 8d32eac and 1cb0208.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• bunfig.toml
• package.json
• server.ts