feat(ci): add Forgejo Actions pipeline with build, test, lint

- Add .forgejo/workflows/ci.yml with matrix (ubuntu/windows), build, test, lint jobs
- Add .eslintrc.cjs with shell:true guard (no-restricted-syntax) and @typescript-eslint rules
- Add lint script to package.json and ESLint v8 devDependencies
- Add CI section to README.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.eslintrc.cjs

@@ -0,0 +1,21 @@
+'use strict';
+module.exports = {
+  root: true,
+  parser: '@typescript-eslint/parser',
+  plugins: ['@typescript-eslint'],
+  extends: ['eslint:recommended', 'plugin:@typescript-eslint/recommended'],
+  rules: {
+    // Sicherheits-Guard: kein shell:true in child_process
+    'no-restricted-syntax': [
+      'error',
+      {
+        selector: 'Property[key.name="shell"][value.value=true]',
+        message: 'shell:true ist verboten — Command-Injection-Risiko. Nutze cross-spawn mit shell:false.'
+      }
+    ],
+    '@typescript-eslint/no-explicit-any': 'warn',
+    '@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
+  },
+  env: { node: true, es2022: true },
+  ignorePatterns: ['dist/', 'node_modules/'],
+};

.forgejo/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  build-and-test:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+      - run: npm ci
+      - run: npm run build
+      - run: npm test
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+      - run: npm ci
+      - run: npm run lint

README.md

@@ -57,3 +57,12 @@ mv ./workspaces/* ~/.disclaw/workspaces/
 ```
 
 Danach die DB-Eintraege in `data/disclaw.db` (Tabelle `workspaces`, Spalte `workspace_path`) aktualisieren.
+
+## CI
+
+Jeder Pull Request gegen `main` durchläuft automatisch:
+- `npm run build` — TypeScript-Kompilierung (Linux + Windows)
+- `npm test` — Vitest Unit- und Integration-Tests (Linux + Windows)
+- `npm run lint` — ESLint mit `shell:true`-Guard
+
+Pipeline-Konfiguration: `.forgejo/workflows/ci.yml`

package.json

@@ -7,7 +7,8 @@
     "build": "tsc",
     "start": "node dist/index.js",
     "dev": "tsc && node dist/index.js",
-    "test": "vitest run"
+    "test": "vitest run",
+    "lint": "eslint src --ext .ts"
   },
   "vitest": {
     "include": ["tests/**/*.test.ts"],
@@ -24,6 +25,9 @@
     "@types/better-sqlite3": "^7.6.0",
     "@types/cross-spawn": "^6.0.6",
     "@types/node": "^22.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.0.0",
+    "@typescript-eslint/parser": "^8.0.0",
+    "eslint": "^8.57.0",
     "typescript": "^5.7.0",
     "vitest": "^4.1.4"
   },