Add pull request CI and a working lint setup

Closes #46.

The repository had no CI for pull requests. Only publish.yml existed, triggered by tags, so a change was first executed by a machine other than the author's at release time. #48 is a 908-line contribution from outside, and reviewing it without an automated build was the immediate reason to fix this.

The new workflow runs on pull requests and on pushes to main: npm ci, lint, build, test, then a check that the build actually produced something. `npm ci` rather than `npm install`, so a pull request whose lockfile disagrees with package.json fails instead of silently resolving something else.

The matrix is Node 18 and 24. 18 is the floor declared in engines, 24 is what publish.yml releases with. Testing only one of them would let through a release that satisfies neither its own engines field nor its own publish path.

The final step verifies dist/cli.js, dist/mcp.js, dist/remote-helper.js and dist/index.js are non-empty and that `node dist/cli.js --version` runs. tsc exiting zero does not prove entry points were emitted, and dist is the entire published package.

test/e2e*.sh are deliberately not run. They drive a real Overleaf account through login, pull, push and compile against a live project. `npm test` globs test/*.test.ts, so the shell suites are already outside it, and the workflow says so in a comment to keep someone from widening the glob later.

eslint.config.js is flat config for eslint 9, with typescript-eslint recommended and without type-checked rules. Those need a TypeScript program per run and would turn lint into a second type checker with its own opinions; tsc already runs in CI and is the authority there.

`no-explicit-any` is a warning rather than an error, and the count is the reason. 58 occurrences remain, all pre-existing, concentrated in client.ts and cli.ts where untyped JSON comes back from Overleaf. Overleaf publishes no schema for those responses, so each one is a typing decision rather than a mechanical fix. As an error, CI would be red on main from the day it is switched on, which teaches everyone to ignore it. As a warning it stays visible and blocks nothing. Worth revisiting once the count is small enough to clear in one pass.

Verified locally: lint, build and test each exit zero, and the workflow parses as YAML.

Author: aloth

.github/workflows/ci.yml

@@ -0,0 +1,65 @@
+name: CI
+
+# Runs on pull requests and on pushes to main. Nothing here publishes; the
+# release path stays in publish.yml, which is triggered by tags only.
+#
+# ⚠️ test/e2e*.sh are deliberately NOT run here. They drive a real Overleaf
+# account: login, pull, push, compile against a live project. `npm test` globs
+# `test/*.test.ts`, so the shell suites are already outside it - do not "fix"
+# that by widening the glob.
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  # A second push to the same PR cancels the first; no point finishing a run
+  # for a commit nobody will merge.
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      # One failing version should not hide the others.
+      fail-fast: false
+      matrix:
+        # 18 is the floor declared in package.json engines, 24 is what
+        # publish.yml ships with. Both are tested because a release that only
+        # works on the newer one would still satisfy the engines field.
+        node-version: ['18', '24']
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+
+      # ci, not install: fails if package-lock.json and package.json disagree,
+      # which is exactly what should stop a pull request.
+      - run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Build
+        run: npm run build
+
+      - name: Test
+        run: npm test
+
+      # The published package is dist/ plus README and LICENSE. A build that
+      # compiles but produces no entry points would otherwise pass everything
+      # above and still ship broken.
+      - name: Verify build output
+        run: |
+          for f in dist/cli.js dist/mcp.js dist/remote-helper.js dist/index.js; do
+            test -s "$f" || { echo "missing or empty: $f"; exit 1; }
+          done
+          node dist/cli.js --version

eslint.config.js

@@ -0,0 +1,48 @@
+// ESLint flat config (ESLint 9). The package is ESM, so this file is too.
+//
+// Scope is deliberately narrow: this exists so `npm run lint` has a working
+// setup behind it and so CI can run it on pull requests. It is not an attempt
+// to restyle the codebase.
+//
+// Type-checked rules are NOT enabled. They need a TypeScript program per run,
+// which is slower and, more to the point, would turn a lint job into a second
+// compiler with its own opinions. `tsc` already runs in CI and is the
+// authority on types.
+import js from "@eslint/js";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  {
+    // dist/ is build output, node_modules/ is not ours. Neither is source.
+    ignores: ["dist/**", "node_modules/**", "coverage/**"],
+  },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    files: ["src/**/*.ts"],
+    rules: {
+      // `_`-prefixed arguments are the established way to say "required by the
+      // signature, unused on purpose" - commander callbacks and catch blocks
+      // both hit this.
+      "@typescript-eslint/no-unused-vars": [
+        "error",
+        {
+          argsIgnorePattern: "^_",
+          varsIgnorePattern: "^_",
+          caughtErrorsIgnorePattern: "^_",
+        },
+      ],
+
+      // Warning, not error, and the number is the reason: 58 occurrences in
+      // src/client.ts and src/cli.ts, all of them pre-existing. They sit where
+      // untyped JSON comes back from Overleaf, which has no published schema,
+      // so each one is a real typing decision rather than a mechanical fix.
+      //
+      // Making this an error would mean CI fails on `main` from the day it is
+      // switched on, which trains everyone to ignore it. As a warning it stays
+      // visible and does not block, and new code can be held to a higher bar in
+      // review. Revisit once the count is low enough to fix in one pass.
+      "@typescript-eslint/no-explicit-any": "warn",
+    },
+  },
+);