Capture deferred cleanup backlog as explicit next steps #4

	name: CI

	on:
	pull_request:
	push:
	branches:
	- main
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	workflow-lint:
	runs-on: ubuntu-latest
	steps:
	- name: Check out repository
	uses: actions/checkout@v4

	- name: Lint workflow syntax
	run: \|
	docker run --rm -v "${{ github.workspace }}:/workspaces" rhysd/actionlint:1.7.7 /workspaces/.github/workflows/ci.yml

	detect-relevant-changes:
	needs: workflow-lint
	runs-on: ubuntu-latest
	outputs:
	run_ci: ${{ steps.change_flags.outputs.run_ci }}
	steps:
	- name: Check out repository
	uses: actions/checkout@v4

	- name: Detect CI-relevant changes
	if: github.event_name != 'workflow_dispatch'
	id: change_filter
	uses: dorny/paths-filter@v3
	with:
	filters: \|
	relevant:
	- 'src/**'
	- 'tests/**'
	- '.github/workflows/**'
	- 'package.json'
	- 'bun.lock'
	- 'tsconfig.json'

	- name: Resolve CI gate
	id: change_flags
	shell: bash
	run: \|
	if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
	echo "run_ci=true" >> "$GITHUB_OUTPUT"
	elif [[ "${{ steps.change_filter.outputs.relevant }}" == "true" ]]; then
	echo "run_ci=true" >> "$GITHUB_OUTPUT"
	else
	echo "run_ci=false" >> "$GITHUB_OUTPUT"
	fi

	validate:
	needs:
	- workflow-lint
	- detect-relevant-changes
	if: needs.detect-relevant-changes.outputs.run_ci == 'true' \|\| github.event_name == 'push'
	runs-on: ubuntu-latest
	steps:
	- name: Check out repository
	uses: actions/checkout@v4

	- name: Set up Bun
	uses: oven-sh/setup-bun@v2
	with:
	bun-version: 1.3.5

	- name: Install dependencies
	run: bun install --frozen-lockfile

	- name: Run typecheck, tests, and build
	run: bun run check

Provide feedback