Add deterministic tests and CI for API Inspector

.github/workflows/ci.yml

@@ -0,0 +1,30 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [20, 22]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+      - name: Install dependencies
+        run: npm ci
+      - name: Build and test
+        run: npm test
+      - name: Verify package contents
+        run: npm pack --dry-run

CONTRIBUTING.md

@@ -0,0 +1,46 @@
+# Contributing to API Inspector
+
+API Inspector is designed to remain auditable, provider-agnostic, and free of runtime dependencies. Contributions should preserve those properties.
+
+## Prerequisites
+
+- Node.js 20 or 22
+- npm 10 or newer
+
+## Local Verification
+
+```bash
+npm ci
+npm test
+npm pack --dry-run
+```
+
+`npm test` builds the TypeScript source and runs deterministic tests with Node's built-in test runner. Required tests must not call a paid provider or depend on a live API key.
+
+## Design Boundaries
+
+- Provider-specific request and response translation belongs in `src/providers/`.
+- Reusable audit behavior belongs in `src/checks/`.
+- Pipeline order and short-circuit behavior belong in `src/pipeline.ts`.
+- Trust-score changes belong in `src/scoring.ts` and must include explicit scoring tests.
+- CLI parsing must remain dependency-free and should be covered in `test/args.test.mjs`.
+
+## Adding a Provider
+
+Implement the shared `ProviderClient` interface, export the adapter through `src/providers/index.ts`, and add deterministic tests with stubbed responses. Document provider-specific limitations. Never commit real credentials or recorded responses containing account data.
+
+## Pull Requests
+
+Keep pull requests focused and include:
+
+- the problem or audit gap;
+- the behavior changed;
+- tests added or updated;
+- commands run and their results;
+- any credential, privacy, or compatibility implications.
+
+Run `git diff --check` before requesting review.
+
+## Security Issues
+
+Do not open a public issue for a vulnerability or exposed credential. Follow [SECURITY.md](./SECURITY.md).