ci: add GitHub Actions validation workflow

Author: vriesdcrv

.github/workflows/ci.yml

@@ -0,0 +1,78 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  workflow-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Lint workflow syntax
+        run: |
+          docker run --rm -v "${{ github.workspace }}:/workspaces" rhysd/actionlint:1.7.7 /workspaces/.github/workflows/ci.yml
+
+  detect-relevant-changes:
+    needs: workflow-lint
+    runs-on: ubuntu-latest
+    outputs:
+      run_ci: ${{ steps.change_flags.outputs.run_ci }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Detect CI-relevant changes
+        if: github.event_name != 'workflow_dispatch'
+        id: change_filter
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            relevant:
+              - 'src/**'
+              - 'tests/**'
+              - '.github/workflows/**'
+              - 'package.json'
+              - 'bun.lock'
+              - 'tsconfig.json'
+
+      - name: Resolve CI gate
+        id: change_flags
+        shell: bash
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            echo "run_ci=true" >> "$GITHUB_OUTPUT"
+          elif [[ "${{ steps.change_filter.outputs.relevant }}" == "true" ]]; then
+            echo "run_ci=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "run_ci=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  validate:
+    needs:
+      - workflow-lint
+      - detect-relevant-changes
+    if: needs.detect-relevant-changes.outputs.run_ci == 'true' || github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.5
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Run typecheck, tests, and build
+        run: bun run check