ci: run the test suite on pull requests

[benglewis]

Problem

The build-test job in .github/workflows/pr.yml installs, builds, packs, installs the tarball and runs baz -h — but never runs a test. Nothing under src/**/*.spec.* gates a merge today, so a regression test can go red while CI stays green.

Split out of #120, where a new regression test would not have been run by CI.

Change

• pr.yml: add a Run tests step to build-test, before the build so it fails fast.
• vitest.config.ts: scope collection to include: ["src/**/*.spec.{ts,tsx}"].

The Vitest scoping is needed for the CI step to be meaningful. tsc copies every spec into dist/, and stale builds and git worktrees leave further copies around, so an unscoped run collects the same test two or three times — and fails outright on copies whose source no longer exists (a dist/components/ScrollableViewport.spec.js with no counterpart in src/ currently does exactly that locally).

Verification

On this branch: npx vitest run collects 2 files / 60 tests from src/ only (was 12 files / 264, mostly duplicates of the same specs). npm run lint and npm run format:check pass.

Note: tsc still emits the specs into dist/, so they ship in the package. Excluding them from the build would also stop type-checking them, so I left that alone — worth a separate look if the packaged size matters.

🤖 Generated with Claude Code

[baz-reviewer]

Generated description

Run the Vitest suite in the build-test workflow before building, and restrict vitest.config.ts test discovery to source specs. Harden GitHub Actions checkouts by disabling persisted credentials for jobs that execute pull request code.

Topics

Topic	Details
Checkout security	Harden workflow checkouts by setting persist-credentials: false before running untrusted pull request code. Modified files (1) .github/workflows/pr.yml Latest Contributors(0) User Commit Date
CI test coverage	Gate pull requests on npm test and prevent duplicate or stale spec collection by limiting Vitest to src/**/*.spec.{ts,tsx}. Modified files (2) .github/workflows/pr.yml vitest.config.ts Latest Contributors(0) User Commit Date

_{Review this PR on Baz | Customize your next review}

[baz-reviewer]

⚠️ Advanced Security cannot run on this PR.

Your organization's Advanced Security usage limit has been reached. To continue using Advanced Security reviews, please upgrade your plan or increase your usage limits in your account settings.