Turn document

# Add typecheck to Forgejo CI

Updated the Forgejo CI workflow so PRs and pushes to `main` install dependencies, run the repository-wide typecheck, run tests, verify the Docker workspace snapshot, and build the production web app.

Created: 2026-05-29 02:28 EDT Beads: islandflow-444 Validation: full CI-equivalent gates passed locally

## Summary

The existing Forgejo CI workflow already ran on pull requests and pushes to `main`. This change adds the new `bun run typecheck` command before tests so TypeScript drift fails early.

## Changes Made

- Added a `Run typecheck` step to `.forgejo/workflows/ci.yml`.
- Kept the existing CI order otherwise: dependency install, tests, Docker workspace snapshot check, web production build.
- Synced `deployment/docker/workspace-root` so the Docker snapshot check includes the new typecheck script and dev dependencies from the root workspace.

## Context

The repo now has a root typecheck command. CI needed to run that command automatically for PRs and pushes to `main`, matching the validation sequence discussed for normal development and release readiness.

## Important Implementation Details

Typecheck runs immediately after `bun install --frozen-lockfile`. That placement keeps failures clear and quick: dependency resolution is proven first, then TypeScript correctness, then behavior tests and production web build validation.

## Relevant Diff Snippets

Attempted to use `@pierre/diffs` previously, but the installed package exposes library exports and no executable CLI. These snippets use the plain diff fallback.

    diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
    @@
           - name: Install dependencies
             run: ~/.bun/bin/bun install --frozen-lockfile

    +      - name: Run typecheck
    +        run: ~/.bun/bin/bun run typecheck
    +
           - name: Run tests
             run: ~/.bun/bin/bun test

    diff --git a/deployment/docker/workspace-root/package.json b/deployment/docker/workspace-root/package.json
    @@
    +    "typecheck": "bun run scripts/typecheck.ts",
    @@
    +    "@types/bun": "^1.3.3",
    +    "@types/ws": "^8.18.1",
    +    "typescript": "^5.9.3",

## Expected Impact for End-Users

Contributors get faster feedback when a PR or `main` push breaks TypeScript. Production web build validation remains part of the same workflow, so UI deploy readiness is still checked before the workflow succeeds.

## Validation

- `bun run typecheck` passed.
- `bun test` passed: 250 tests, 0 failures.
- `bun run check:docker-workspace` passed after syncing the snapshot.
- `bun --cwd=apps/web run build` passed.

## Issues, Limitations, and Mitigations

This is still a single validation job rather than multiple independent jobs. That keeps the workflow simple and preserves ordering, but it means later checks wait for earlier checks to finish. Parallelization can be added later if runtime becomes a problem.

## Follow-up Work

No required follow-up remains for this task. Existing issue `islandflow-3ys` still tracks broader CI expansion such as Docker image builds and service-container integration tests.