Add main CI quality gate

Author: willamhou

.github/workflows/ci.yml

@@ -0,0 +1,60 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  linux:
+    name: Linux Checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Format Check
+        run: cargo fmt --check
+
+      - name: Library Tests
+        run: cargo test --lib -- --test-threads=1
+
+      - name: Build Debug Binary
+        run: cargo build --bin deepseek
+
+      - name: Secret Scan
+        run: node scripts/check-secrets.js
+
+      - name: Demo Evidence Checks
+        run: |
+          bash -n docs/demo/record-model-backed-demo.sh
+          docs/demo/record-model-backed-demo.sh --dry-run
+          docs/demo/record-model-backed-demo.sh --redaction-self-test
+          docs/demo/verify-model-backed-demo.js --self-test
+          docs/demo/render-model-backed-demo-svg.js --self-test
+
+      - name: npm Metadata Checks
+        run: |
+          node npm/scripts/check-version-sync.js
+          npm --prefix npm test
+
+      - name: npm Wrapper TUI Entrypoint Smoke
+        env:
+          DEEPSEEK_BINARY: target/debug/deepseek
+        run: node npm/scripts/test-tui-entrypoint-wrapper.js
+
+      - name: Homebrew Formula Check
+        run: node packaging/homebrew/verify-formula.js

docs/superpowers/plans/2026-05-10-deepseek-tui-parity.md

@@ -155,6 +155,9 @@ checks now run the recorder dry-run, redaction self-test, verifier self-test,
 and model-backed SVG renderer self-test without requiring API credentials.
 Release packaging now also runs `node scripts/check-secrets.js`, a tracked-file
 secret scan that blocks committed `sk-...` style API tokens before publishing.
+Normal `main` pushes and pull requests now also run `.github/workflows/ci.yml`,
+a Linux CI gate covering Rust fmt/lib tests/build, secret scanning, demo
+evidence self-tests, npm metadata/wrapper smoke, and Homebrew formula checks.
 The largest remaining DeepSeek-TUI / Claude Code CLI / Codex CLI gaps are now:
 
 - broader terminal/platform proof beyond the TTY-aware default TUI entrypoint,

docs/superpowers/specs/2026-05-18-deepseek-tui-main-ci-gate.md

@@ -0,0 +1,38 @@
+# DeepSeek-TUI Main CI Gate
+
+**Status:** implemented
+**Comparison source:** `Hmbown/DeepSeek-TUI` refreshed at `/tmp/deepseek-tui-compare-20260514`, latest fetched `origin/main` `eeccf7d`.
+
+## Gap
+
+The repository had a release workflow for tags and manual dispatch, but normal
+`main` pushes and pull requests did not run a public CI gate. That left recent
+release-proof work dependent on local checks until the next tag workflow.
+
+## Implementation
+
+- Added `.github/workflows/ci.yml`.
+- The CI workflow runs on `main` pushes, pull requests, and manual dispatch.
+- Linux checks cover Rust formatting, library tests, debug `deepseek` build,
+  secret scanning, model-demo recorder/verifier/renderer self-tests, npm
+  metadata checks, npm wrapper TUI entrypoint smoke, and Homebrew formula
+  validation.
+- The workflow keeps expensive release-only work such as Docker packaging,
+  attestation, npm publishing, and tap publishing in the release matrix.
+
+## Verification
+
+- Local equivalents:
+  - `cargo fmt --check`
+  - `cargo test --lib -- --test-threads=1`
+  - `cargo build --bin deepseek`
+  - `node scripts/check-secrets.js`
+  - `docs/demo/record-model-backed-demo.sh --dry-run`
+  - `docs/demo/record-model-backed-demo.sh --redaction-self-test`
+  - `docs/demo/verify-model-backed-demo.js --self-test`
+  - `docs/demo/render-model-backed-demo-svg.js --self-test`
+  - `node npm/scripts/check-version-sync.js`
+  - `npm --prefix npm test`
+  - `DEEPSEEK_BINARY=target/debug/deepseek node npm/scripts/test-tui-entrypoint-wrapper.js`
+  - `node packaging/homebrew/verify-formula.js`
+  - `git diff --check`