[SemiKyle]

Why

Dependabot autopilot merges a security update only when a real build or test check passes on the PR. This repo had no CI, so no update could qualify, and people's PRs had no build check either.

What the job runs

One job, build:

1. uv venv and uv pip install -r frameworks/tinker/requirements.txt (the pinned file Dependabot watches).
2. The repo's documented offline checks: python -m unittest discover -s tests and python -m unittest discover -s frameworks/tinker -p 'test_*.py'.

The tests use unittest, as the README documents, so the job runs them with unittest instead of pytest.

The job needs no secrets. It installs from public registries and does not change any lockfile or dependency. Actions are pinned by commit SHA. It runs on every PR and on pushes to the default branch, with read-only contents permission and a 20 minute timeout.

---

Note

Low Risk
Adds CI configuration only; no application, auth, or dependency lockfile changes.

Overview
Adds a GitHub Actions CI workflow so every pull request and push to master gets an automated build gate—enabling Dependabot to require a passing check before merging security updates.

The single build job runs on Ubuntu with read-only repo permissions, SHA-pinned checkout/setup actions, and concurrency that cancels duplicate runs. It creates a Python 3.12 venv with uv, installs frameworks/tinker/requirements.txt (the pinned file Dependabot tracks), then runs the documented offline unittest suites under tests and frameworks/tinker.

^{Reviewed by Cursor Bugbot for commit 16e3e3d. Bugbot is set up for automated code reviews on this repo. Configure here.}