[Copilot]

No CI existed for this repo. This adds a lightweight GitHub Actions workflow that runs four linting/validation jobs in parallel on every PR targeting main.

Workflow: .github/workflows/pr-checks.yml

• shellcheck — lints clide and entrypoint.sh via ludeeus/action-shellcheck@master
• hadolint — enforces Dockerfile best practices via hadolint/hadolint-action@v3.1.0
• compose-validate — validates docker-compose.yml with docker compose config --quiet
• markdown-lint — lints Markdown docs via DavidAnson/markdownlint-cli2-action@v19

All jobs run in parallel on ubuntu-latest with no inter-job dependencies. A top-level permissions: contents: read block is included to enforce least-privilege on GITHUB_TOKEN.

Original prompt

Add a GitHub Actions workflow at .github/workflows/pr-checks.yml that runs lightweight, fast checks on every pull request targeting main. The repo is Shell-based with a Dockerfile, docker-compose.yml, Makefile, and Markdown docs. There are currently no CI workflows.

The workflow should contain the following four jobs, all running in parallel on ubuntu-latest:

1. ShellCheck — Lint shell scripts

Catches bugs, quoting issues, and bad practices in shell scripts (clide, entrypoint.sh).

shellcheck:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - uses: ludeeus/action-shellcheck@master

2. Hadolint — Lint the Dockerfile

Enforces Dockerfile best practices (relevant to upcoming security hardening issues like non-root user, dependency pinning, healthcheck).

hadolint:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - uses: hadolint/hadolint-action@v3.1.0

3. Docker Compose Validate — Validate compose files

Ensures docker-compose.yml stays syntactically valid as hardening options are added.

compose-validate:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - run: docker compose config --quiet

4. Markdown Lint — Validate documentation

Keeps Markdown files clean as new documentation is added (architecture diagram, runbook, compatibility matrix, threat model).

markdown-lint:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - uses: DavidAnson/markdownlint-cli2-action@v19

Full workflow trigger:

name: PR Checks
on:
  pull_request:
    branches: [main]

All four jobs should run in parallel (no dependencies between them). This keeps the total CI time under 15 seconds on the free GitHub Actions tier.

This pull request was created from Copilot chat.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.