From 8d6e2ab4a7ada79b9044ba9eedc55ba95b2fb21f Mon Sep 17 00:00:00 2001
From: winrid <winrid@gmail.com>
Date: Thu, 18 Jun 2026 22:37:51 -0700
Subject: [PATCH 1/2] Add GitHub Actions CI workflow

---
 .github/workflows/ci.yml | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c2b2aa7
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,39 @@
+name: CI
+
+# Runs on PRs and pushes to the default branch. We use `pull_request` (never
+# `pull_request_target`), so secrets are NOT exposed to pull requests from forks.
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+      - name: Install dependencies
+        run: npm ci
+      # Compile the committed generated sources; do not regenerate from the spec in CI.
+      - name: Compile
+        run: npm run compile
+      - name: Run unit tests
+        run: npm run test:unit
+      - name: Run integration tests
+        run: npm run test:integration
+        env:
+          FASTCOMMENTS_API_KEY: ${{ secrets.FASTCOMMENTS_API_KEY }}
+          FASTCOMMENTS_TENANT_ID: ${{ secrets.FASTCOMMENTS_TENANT_ID }}
+      - name: Run browser compatibility tests
+        run: npm run test:browser

From b6365d0702199fd4725c5ea1b58763fcab2f5cb1 Mon Sep 17 00:00:00 2001
From: winrid <winrid@gmail.com>
Date: Thu, 18 Jun 2026 22:42:50 -0700
Subject: [PATCH 2/2] CI: provide test credentials to all test steps

---
 .github/workflows/ci.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c2b2aa7..667436c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,6 +17,11 @@ concurrency:
 jobs:
   test:
     runs-on: ubuntu-latest
+    # The test harness (src/__tests__/env.ts) eagerly requires these on import,
+    # so every test step (unit/integration/browser) needs them.
+    env:
+      FASTCOMMENTS_API_KEY: ${{ secrets.FASTCOMMENTS_API_KEY }}
+      FASTCOMMENTS_TENANT_ID: ${{ secrets.FASTCOMMENTS_TENANT_ID }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -32,8 +37,5 @@ jobs:
         run: npm run test:unit
       - name: Run integration tests
         run: npm run test:integration
-        env:
-          FASTCOMMENTS_API_KEY: ${{ secrets.FASTCOMMENTS_API_KEY }}
-          FASTCOMMENTS_TENANT_ID: ${{ secrets.FASTCOMMENTS_TENANT_ID }}
       - name: Run browser compatibility tests
         run: npm run test:browser