Add canonical source gate and CI

.github/workflows/ci.yml

@@ -0,0 +1,45 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: pdf-accessibility-ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  UV_LOCKED: "1"
+
+jobs:
+  source-gate:
+    name: Source gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12.13"
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.32"
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+      - name: Install backend dependencies
+        working-directory: backend
+        run: uv sync --locked --extra dev
+      - name: Install frontend dependencies
+        working-directory: frontend
+        run: bun install --frozen-lockfile
+      - name: Run canonical source gate
+        run: ./scripts/check.sh

README.md

@@ -237,6 +237,12 @@ bun run lint
 bun run build
 ```
 
+From the repository root, run the credential-free backend/frontend check:
+
+```bash
+./scripts/check.sh
+```
+
 Verify the effective runtime (LLM provider, Docling target, installed binaries) with:
 
 ```bash

scripts/check.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+
+(
+  cd "$repo_root/backend"
+  env \
+    GEMINI_API_KEY= \
+    GOOGLE_API_KEY= \
+    LLM_API_KEY=check-only \
+    LLM_BASE_URL=http://127.0.0.1:8000/v1 \
+    LLM_MODEL=gemini-check \
+    USE_DIRECT_GEMINI_PDF=false \
+    DOCLING_SERVE_URL= \
+    DOCLING_SERVE_TOKEN= \
+    PYTHONPATH=. \
+    uv run pytest tests -q
+)
+
+(
+  cd "$repo_root/frontend"
+  bun run lint
+  bun run build
+)