[devin-ai-integration]

Summary

The only workflow was build-release.yml, which runs on version tags, so none of the checks CONTRIBUTING.md asks for ran on a pull request. This adds .github/workflows/ci.yml, triggered on pull_request, pushes to main and workflow_dispatch, with one job per check so each can be made a required status on its own:

job	runs	same as
ruff	ruff check ., ruff format --check .	make lint-check, make format-check
mypy	mypy strix/	first half of make type-check
bandit	bandit -r strix/ -c pyproject.toml	make security
pytest (3.12 / 3.13 / 3.14)	pytest -q on every Python the project classifies	uv run pytest
tui	gofmt -l, go vet, CGO_ENABLED=0 go build, go test -race	make tui-lint, make tui-build, make tui-test
viewer	npm ci, npm run build, then the committed strix/interface/viewer/static/ must equal the fresh build	make viewer, plus a freshness check

Every tool runs through uv run --frozen, so the versions are the ones in uv.lock. Actions are pinned to the same commit SHAs as build-release.yml (setup-node is new and pinned to v7.0.0), permissions is read-only, persist-credentials: false, and a concurrency group cancels superseded runs on the same ref. actionlint passes.

Two things keep the first run on main honest:

• .pre-commit-config.yaml pinned ruff v0.11.13 while uv.lock has 0.15.20; the two disagree on tests/test_tool_call_ids_providers.py:109 (N802 on do_POST vs. RUF100 for the then-unused noqa), so whichever one you ran, the other was red. The hook now uses v0.15.20 and the stale noqa is dropped.
• pyright (second half of make type-check) is not gated: it reports 909 errors on main today and needs its own baseline first.

pytest on main currently fails one test, test_resolves_common_bare_model_names; that fix is in #1423 so this workflow is green once both land.

Part of STR-617

Link to Devin session: https://app.devin.ai/sessions/dca9d4eea9114d6db88b5b374105df30
Open in Devin Desktop: https://app.devin.ai/desktop/session/dca9d4eea9114d6db88b5b374105df30?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Confidence Score: 5/5

[High risk] Adds and restructures continuous integration workflows.

The PR appears safe to merge based on the reviewed changes.

Summary

The PR adds pull-request CI for Python, the Go TUI, the viewer, package builds, and GitHub Actions workflows. It also adds weekly dependency updates and aligns a few existing build and lint settings.

• Separate check groups feed one final CI status.
• Package checks cover the wheel and frozen binary; viewer checks compare the build with committed files.

_{Reviews (2) · Last reviewed commit: "ci: drop the CodeQL workflow"}