chore(ci): add frontend API validation workflow

[IvGolovach]

Summary

• add a repo-owned GitHub Actions workflow for frontend and API test coverage
• run the existing frontend Vitest API and lib suites whenever frontend code or its lockfile inputs change

Why

Right now, the repository's built-in GitHub Actions checks mainly cover Rust paths. That leaves packages/frontend/** without a repo-owned validation gate, even though the project already has meaningful frontend API and library test coverage. This change closes that gap with the smallest reliable workflow that fits the current state of main.

Diff scope

• add a new workflow at .github/workflows/frontend_api_validation.yml
• trigger that workflow for push and pull_request events when packages/frontend/**, package.json, or bun.lock change
• set up Bun, install dependencies with bun install --frozen-lockfile, and run the existing frontend API and lib Vitest suites
• intentionally leave out frontend typecheck and build steps from this PR because current main still has an unrelated typecheck blocker outside this diff

Test proof

• bun install --frozen-lockfile
  • passed
• bun x vitest run packages/frontend/__tests__/api/*.test.ts packages/frontend/__tests__/lib/*.test.ts
  • 15 files, 113 tests passed
• git diff --check
  • passed

Verification-pack proof

Not applicable - this PR adds a small repo-owned workflow but does not change runtime logic, infrastructure, or migration behavior.

Migration notes

Not applicable - no schema or data migration.

CI context confirmation

CI context names unchanged.

Rollback plan

• if merged with a merge commit: git revert <merge_commit_sha>
• if merged as a squash commit: git revert <squash_commit_sha>
• no DB downgrade required

Known residual risks

• this workflow covers the existing frontend API and library test surface, not the full Next.js build or typecheck surface
• frontend typecheck is intentionally left out because current main still has an unrelated missing-asset error in BlackholeHero.tsx that this PR does not introduce or change

[vercel]

@IvGolovach is attempting to deploy a commit to the Inevitable Team on Vercel.

A member of the Team first needs to authorize it.

[cubic-dev-ai]

2 issues found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/frontend_api_validation.yml">

<violation number="1" location=".github/workflows/frontend_api_validation.yml:3">
P2: Workflow lacks explicit `permissions`, leaving GITHUB_TOKEN scope to defaults; restrict to least-privilege (e.g., `contents: read`) since this job only runs tests.</violation>

<violation number="2" location=".github/workflows/frontend_api_validation.yml:26">
P2: Third-party GitHub Action is referenced by a mutable tag instead of a pinned commit SHA, which increases supply-chain risk.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}