ci: GitHub Actions CI + eslint/editorconfig + manifest 守护测试

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+
+[*.md]
+# Markdown 依赖行尾双空格做硬换行,不裁剪
+trim_trailing_whitespace = false

.github/workflows/ci.yml

@@ -0,0 +1,24 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  test:
+    name: test (${{ matrix.os }}, node ${{ matrix.node }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        node: [18, 22]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+      - run: npm ci
+      - run: npm test
+      - run: npm run lint

.gitignore

@@ -5,3 +5,6 @@ CLAUDE.local.md
 # OS
 .DS_Store
 Thumbs.db
+
+# Node
+node_modules/

CLAUDE.md

@@ -6,7 +6,7 @@
 
 1. **版本同步**：任何功能性改动（skill/references 内容、agent、hook 行为）必须同步 bump `.claude-plugin/plugin.json` 的 `version`；纯 README/LICENSE 改动不 bump。
 2. **hook 静默契约**：`hooks/guard.js` 在目标项目既无 `eng-vibe.config.json` 也无 `guard`/`test:guard` npm script 时，必须零输出、exit 0（README 承诺的"零打扰"）。另外它有信任门槛（见 SECURITY.md）：未信任项目不执行命令只提示，`--untrust` 过的项目静默放行；信任记录在 `~/.claude/eng-vibe-trust.json`，测试时必须用 `ENG_VIBE_TRUST_STORE` 指向临时文件隔离。改 hook 后必须在「无配置」「未信任」「已信任」三种目录下各实际跑一次验证。
-3. **跨文件引用一致性**：以下名称被多处引用，改任何一端必须 grep 全仓库同步：
+3. **跨文件引用一致性**：以下名称被多处引用，改任何一端必须 grep 全仓库同步（机器守护：`tests/manifest.test.js`，挂了 CI 会红）：
    - 子代理名 `eng-vibe-reviewer`：agents/ 文件名 + SKILL.md 第 5 步 + README
    - 配置名 `eng-vibe.config.json` 与字段 `guardCommand`：hooks/guard.js + SKILL.md 第 2 步 + README
 4. **双语规范**：README.md 中英对照，改一种语言必须同步另一种；skill 和模板正文只用中文。
@@ -17,3 +17,4 @@
 - 改六步工作流 → `skills/eng-vibe/SKILL.md`（检查引用的 references/ 是否需同步）→ bump version
 - 改守护 hook → `hooks/guard.js` → `npm test` 全绿(新增分支必须配对应用例,故意违反一次看它红)→ bump version
 - 加 reference 文档 → `skills/eng-vibe/references/` + SKILL.md 加链接 + README 结构树补一行（中英双语）
+- 改 CI / lint → `.github/workflows/ci.yml` / `eslint.config.js` → 本地 `npm test && npm run lint` 绿

README.md

@@ -1,5 +1,7 @@
 # eng-vibe — Engineering-Grade Vibe Coding Skill
 
+[![CI](https://github.com/libinyam/engineering-vibe-coding/actions/workflows/ci.yml/badge.svg)](https://github.com/libinyam/engineering-vibe-coding/actions/workflows/ci.yml)
+
 一个 Claude Code skill,把 vibe coding 从"能跑的 demo"推向"敢上线收钱的可交付项目"。
 
 A Claude Code skill that pushes vibe coding from "a demo that runs" to "a product you'd charge money for."
@@ -67,13 +69,18 @@ cp -r engineering-vibe-coding/skills/eng-vibe ~/.claude/skills/
 .claude-plugin/
   plugin.json                         # plugin 清单 / plugin manifest
   marketplace.json                    # 让本仓库可被 /plugin marketplace add / makes this repo installable
+.github/workflows/ci.yml              # CI:测试 + manifest 校验 + lint / tests + manifest checks + lint
 agents/
   eng-vibe-reviewer.md                # 对抗审查子代理 / adversarial reviewer subagent
 hooks/
   hooks.json                          # PostToolUse 事件绑定 / event binding
   guard.js                            # 守护测试自动执行脚本 / guard-test runner
   guard.test.js                       # guard.js 全分支测试 / black-box tests for guard.js
-package.json                          # 测试入口 / test entrypoint
+tests/
+  manifest.test.js                    # manifest/跨文件引用守护 / manifest & cross-reference guard tests
+eslint.config.js                      # lint 基线 / lint baseline
+.editorconfig                         # 格式基线 / format baseline
+package.json                          # npm test / npm run lint 入口 / entrypoints
 skills/eng-vibe/
   SKILL.md                            # 六步工作流主文档 / main workflow
   references/
@@ -85,9 +92,12 @@ skills/eng-vibe/
 ## 开发 / Development
 
 ```bash
-npm test   # 零依赖,Node ≥18 / zero dependencies, Node ≥18
+npm test        # 19 个用例:guard 全分支 + manifest 守护 / 19 cases: guard branches + manifest guards
+npm run lint    # eslint / eslint
 ```
 
+运行时零依赖,需 Node ≥18(lint 仅 devDependencies)/ Zero runtime dependencies, Node ≥18 (eslint is devDependency only).
+
 ## Roadmap
 
 - [x] 升级为 Claude Code plugin:打包 reviewer 子代理 + 守护 hooks(编辑后自动跑守护测试)

eslint.config.js

@@ -0,0 +1,24 @@
+'use strict';
+
+// 本仓库只有零散几个 JS 文件(hook + 测试),lint 目标是守住会红的基础项,
+// 不做风格微管;格式约定交给 .editorconfig。
+const js = require('@eslint/js');
+const globals = require('globals');
+
+module.exports = [
+  {
+    ignores: ['package-lock.json'],
+  },
+  {
+    files: ['**/*.js'],
+    languageOptions: {
+      ecmaVersion: 2023,
+      sourceType: 'commonjs',
+      globals: { ...globals.node },
+    },
+    rules: {
+      ...js.configs.recommended.rules,
+      'no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
+    },
+  },
+];