ci: add GitHub Actions workflow for python quality, tests, notebook freeze, and frontend build

.github/workflows/ci.yml

@@ -0,0 +1,124 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  PIP_DISABLE_PIP_VERSION_CHECK: "1"
+  PYTHONDONTWRITEBYTECODE: "1"
+
+jobs:
+  python-quality:
+    name: Python quality (ruff + mypy)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: |
+            requirements.txt
+            requirements-dev.txt
+            requirements-eval.txt
+            pyproject.toml
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt -r requirements-eval.txt
+          pip install -e .
+
+      - name: Ruff lint
+        run: ruff check src/captioning backend scripts tests
+
+      - name: Ruff format check
+        run: ruff format --check src/captioning backend scripts tests
+
+      - name: Mypy
+        run: mypy src/captioning backend/app scripts
+
+  python-tests:
+    name: pytest (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: |
+            requirements.txt
+            requirements-dev.txt
+            requirements-eval.txt
+            pyproject.toml
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt -r requirements-eval.txt
+          pip install -e .
+
+      - name: Run pytest
+        run: pytest tests backend/app/tests -v --maxfail=5
+
+  notebook-freeze:
+    name: Notebook SHA-256 freeze
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Verify IEEE notebook is byte-stable
+        run: make freeze-paper-notebook
+
+  frontend:
+    name: Frontend (lint + build)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Build
+        run: npm run build

README.md

@@ -550,9 +550,9 @@ The backend test suite ([`backend/app/tests/`](backend/app/tests/)) introduced i
 - [ ] **WS-E** — Frontend deploy to Vercel (static SPA, `VITE_API_BASE` baked at build time, SPA rewrites)
 - [ ] **WS-F** — Production CORS: add the deployed Vercel origin to `serve.cors_allowed_origins`
 - [ ] **WS-G** — GitHub Actions CI/CD:
-  - `ci.yml` — Python quality matrix (ruff, mypy, pytest on 3.10/3.11/3.12), notebook SHA-256 freeze check, frontend lint + build, concurrency cancel-in-progress, pip + npm caching
-  - `deploy-backend.yml` — gated on `needs: ci`, pushes to the HF Space
-  - `deploy-frontend.yml` *(optional)* — Vercel-native GitHub integration is the recommended path
+  - [x] `ci.yml` — Python quality (ruff lint + format check, mypy), pytest matrix on 3.10/3.11/3.12, notebook SHA-256 freeze check, frontend lint + build, concurrency cancel-in-progress, pip + npm caching
+  - [ ] `deploy-backend.yml` — gated on `needs: ci`, pushes to the HF Space
+  - [ ] `deploy-frontend.yml` *(optional)* — Vercel-native GitHub integration is the recommended path
 - [ ] **WS-H** — README "Live Demo" section (badges swapped to live HF Space + Vercel URLs) + `docs/PHASE_2C_DEPLOYMENT_RUNBOOK.md` + `docs/CI.md`
 
 ### Phase 3 — Multimodal baselines ⏳ (planned)