ci: add GitHub Actions workflow for Rust and UI

[JustAGhosT]

What

Adds .github/workflows/ci.yml. The repo had no CI at all — .github/workflows/ did not exist, and nothing ran tests on push or PR.

Two jobs, both on ubuntu-latest, both with timeout-minutes:

Job	Steps	Timeout
Rust	cargo fmt --all --check, cargo clippy --workspace --all-targets, cargo test --workspace	40 min
UI (app/)	npm ci, npx tsc --noEmit, vitest, npm run build	20 min

Caching: Swatinem/rust-cache@v2 for the cargo registry/git/target dir, and actions/setup-node@v5 with cache: npm keyed on app/package-lock.json.

Why now

During #3 the UI suite was running zero tests and still reporting success. app/src/test/setup.ts built a second JSDOM on top of vitest's jsdom environment, so render wrote to one document while screen queried another; the forks pool hung and printed "no tests" with a zero exit code. Three failing camera tests were invisible through three review rounds. That was fixed in #3 — but nothing would have caught it, and nothing would catch the next one.

Guarding the silent-zero specifically

Two layers, both verified rather than assumed:

1. npx vitest run --passWithNoTests=false instead of the npm test script. npm test is a bare vitest, i.e. watch mode — it only terminates under CI because vitest happens to detect $CI, which is too implicit to hang a merge gate on. I confirmed the flag produces a non-zero exit on an empty run before relying on it (a run matching no test files exits 1).
2. An explicit "tests actually ran" assertion. --passWithNoTests only covers "no test files were found". It does not cover "files were collected but zero tests executed", which is closer to what actually happened in feat(camera): add private local viewer #3. So the test step also emits a JSON report and a follow-up step fails the job unless numTotalTests >= 1.

I proved the gate bites rather than trusting a green check: a deliberate empty run on this branch turned the UI job red at the Test step (No test files found, exiting with code 1), while the Rust job stayed green. That commit is not part of this PR.

Verification

Both jobs ran green on this branch before the PR was opened (run 31391034448) — not just "the YAML parses":

• Rust: fmt clean, clippy clean, cargo test --workspace ran 16 tests (5 deck + 3 deck-camera + 8 deck-contracts). The Tauri crate compiles on Linux with the installed system deps.
• UI: vitest executed 51 tests (51 passed) across 5 files, typecheck and build clean.

Judgement calls

Tauri system deps are installed rather than scoping the Rust job. app/src-tauri is a real Tauri 2 app, so the workspace needs the webkit2gtk/libsoup stack; deck-camera additionally pulls keyring → secret-service → libdbus-sys, hence libdbus-1-dev. Scoping to -p deck-camera -p deck-contracts would have skipped the largest crate (28 source files) and the exact files carrying the known clippy warnings. Installing the deps costs ~30s and keeps --workspace honest.

Clippy runs without -D warnings. app/src-tauri currently has 6 warnings — 4 in services/helpers.rs, 1 in services/ports.rs, 1 in services/status.rs. Denying warnings before fixing them would fail the job on arrival. There is a comment in the workflow saying to add -- -D warnings once they are fixed, so the count cannot quietly grow.

Noted, not fixed here

The reconnect/backoff and frame-inactivity-timeout logic in crates/deck-camera/src/lib.rs has no test coverage. deck-camera's 3 tests only cover credential/locator validation. That is the most intricate logic in the crate and it is currently unguarded — worth its own PR.

Also worth knowing: app/src-tauri/gen/ is generated by the Tauri build and is not covered by .gitignore, so it shows up as untracked after a local build. Left alone deliberately, as it is unrelated to CI.

Summary by CodeRabbit

• Chores

  • Added automated checks for code formatting, linting, typechecking, tests, test-report validation, and production builds.
  • CI now runs for pull requests and updates to the main development branches.
  • Added safeguards to cancel outdated runs and restrict repository access.

• Refactor

  • Excluded generated test reports from version control.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

📝 Walkthrough

Walkthrough

Added a GitHub Actions workflow for Rust and UI checks on pull requests and pushes to dev or main. The workflow validates formatting, linting, tests, typechecking, Vitest reports, and production builds. CI-generated reports are ignored.

Changes

Continuous integration validation

Layer / File(s)	Summary
Workflow controls and Rust validation .github/workflows/ci.yml	The workflow defines pull request and branch triggers, cancels superseded runs, uses read-only contents access, installs Linux dependencies, configures stable Rust tooling, caches Cargo data, and runs formatting, Clippy, and workspace tests.
UI checks and production build .github/workflows/ci.yml, app/.gitignore	The UI job installs Node dependencies, runs TypeScript checks, executes Vitest with a JSON report, validates that the report contains tests, builds the application, and ignores the generated report.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding GitHub Actions CI for both Rust and UI components.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/add-github-actions-workflow

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/ci.yml (1)

22-22: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Disable persisted checkout credentials.

Both checkouts run dependency-managed code afterward and no later step uses authenticated Git access. Set persist-credentials: false on line 22 and line 73.

Proposed fix

-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 22, Disable persisted checkout credentials
for both actions/checkout@v5 steps: update .github/workflows/ci.yml lines 22-22
and 73-73 to set persist-credentials to false.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/ci.yml:
- Line 22: Disable persisted checkout credentials for both actions/checkout@v5
steps: update .github/workflows/ci.yml lines 22-22 and 73-73 to set
persist-credentials to false.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 859c0c1c-593f-4a3e-8f96-45ca180b3868

📥 Commits

Reviewing files that changed from the base of the PR and between eb7e9c7 and f2ce3aa.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• app/.gitignore