add CI, repo security, and hygiene

.github/dependabot.yml

@@ -0,0 +1,34 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: America/Chicago
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: chore
+    labels:
+      - dependencies
+    groups:
+      npm-dependencies:
+        patterns:
+          - "*"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:15"
+      timezone: America/Chicago
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: chore
+    labels:
+      - dependencies
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          filter: tree:0
+          fetch-depth: 0
+      - uses: pnpm/action-setup@v4
+        name: Install pnpm
+        with:
+          run_install: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm exec nx run-many -t lint test typecheck build --projects=foundry-ai --outputStyle=static

README.md

@@ -2,12 +2,14 @@
 
 Typed TypeScript SDK for Palantir Foundry's LLM proxy endpoints, built on the Vercel AI SDK.
 
-[![TypeScript](https://img.shields.io/badge/TypeScript-5.8.3-3178c6?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
-[![AI%20SDK](https://img.shields.io/badge/AI%20SDK-6.0.138-000000?logo=vercel&logoColor=white)](https://sdk.vercel.ai/)
-[![Nx](https://img.shields.io/badge/Nx-21.0.0-143055?logo=nx&logoColor=white)](https://nx.dev/)
+[![TypeScript](https://img.shields.io/badge/TypeScript-6.0.2-3178c6?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
+[![AI%20SDK](https://img.shields.io/badge/AI%20SDK-6.0.140-000000?logo=vercel&logoColor=white)](https://sdk.vercel.ai/)
+[![Nx](https://img.shields.io/badge/Nx-22.6.2-143055?logo=nx&logoColor=white)](https://nx.dev/)
 [![pnpm](https://img.shields.io/badge/pnpm-10.24.0-f69220?logo=pnpm&logoColor=white)](https://pnpm.io/)
-[![Biome](https://img.shields.io/badge/Biome-2.3.0-60a5fa)](https://biomejs.dev/)
-[![Vitest](https://img.shields.io/badge/Vitest-3.2.0-6e9f18?logo=vitest&logoColor=white)](https://vitest.dev/)
+[![Biome](https://img.shields.io/badge/Biome-2.4.9-60a5fa)](https://biomejs.dev/)
+[![Vitest](https://img.shields.io/badge/Vitest-4.1.2-6e9f18?logo=vitest&logoColor=white)](https://vitest.dev/)
+[![CI](https://github.com/nyrra-labs/nyrra-foundry-ai/actions/workflows/ci.yml/badge.svg)](https://github.com/nyrra-labs/nyrra-foundry-ai/actions/workflows/ci.yml)
+[![DeepWiki](https://img.shields.io/badge/DeepWiki-nyrra--labs%2Fnyrra--foundry--ai-blue.svg)](https://deepwiki.com/nyrra-labs/nyrra-foundry-ai)
 [![License](https://img.shields.io/badge/license-MIT-0f172a)](./LICENSE)
 
 ## What It Does
@@ -33,12 +35,12 @@ The root package exports shared catalog, config, error, and middleware utilities
 
 | Layer | Present | Tooling | Runs in CI |
 |---|---|---|---|
-| unit | yes | Vitest | no |
+| unit | yes | Vitest | yes |
 | integration | no | none | no |
 | e2e api | yes | Vitest live tests + manual Bun/Node example scripts against live Foundry | no |
 | e2e web | no | none | no |
 
-This repo does not have CI configured yet. Live API verification is manual and requires Foundry credentials. Use `pnpm test:live` for the live Vitest suite or run the standalone scripts in [`examples/`](./examples).
+GitHub Actions now runs lint, unit tests, typecheck, and build on `main` and pull requests. Live API verification still requires Foundry credentials and remains manual through `pnpm test:live` or the standalone scripts in [`examples/`](./examples).
 
 ## Quick Start
 

SECURITY.md

@@ -0,0 +1,18 @@
+# Security Policy
+
+## Supported Versions
+
+This project is pre-1.0 and not published yet. Security fixes land on the latest `main` branch. Once npm releases start, only the latest published release and `main` should be considered supported.
+
+## Reporting a Vulnerability
+
+Use GitHub private vulnerability reporting for this repository. Do not open a public issue for suspected vulnerabilities.
+
+Please include:
+
+- the affected provider path or SDK surface
+- reproduction steps
+- expected impact
+- logs or traces with secrets redacted
+
+Maintainers aim to acknowledge reports within 3 business days and follow up with either a remediation plan or a triage update.

nx.json

@@ -9,6 +9,18 @@
       "{workspaceRoot}/tsconfig.base.json",
       "{workspaceRoot}/biome.json"
     ],
+    "workspaceLintFiles": [
+      "{workspaceRoot}/.github/**",
+      "{workspaceRoot}/AGENTS.md",
+      "{workspaceRoot}/README.md",
+      "{workspaceRoot}/SECURITY.md",
+      "{workspaceRoot}/docs/**",
+      "{workspaceRoot}/examples/**",
+      "{workspaceRoot}/justfile",
+      "{workspaceRoot}/opencode.jsonc",
+      "{workspaceRoot}/scripts/**",
+      "{workspaceRoot}/tsconfig.json"
+    ],
     "default": ["{projectRoot}/**/*", "sharedGlobals"],
     "production": [
       "default",
@@ -28,7 +40,7 @@
     },
     "lint": {
       "cache": true,
-      "inputs": ["default", "^default"]
+      "inputs": ["default", "^default", "workspaceLintFiles"]
     },
     "test": {
       "cache": true,

package.json

@@ -20,13 +20,13 @@
     "@ai-sdk/openai": "3.0.48",
     "@biomejs/biome": "2.4.9",
     "@exalabs/ai-sdk": "2.0.1",
-    "@nx/js": "22.6.1",
+    "@nx/js": "22.6.2",
     "@swc-node/register": "~1.11.1",
     "@swc/core": "~1.15.21",
     "@swc/helpers": "~0.5.20",
     "@types/node": "25.5.0",
-    "ai": "6.0.138",
-    "nx": "22.6.1",
+    "ai": "6.0.140",
+    "nx": "22.6.2",
     "tslib": "2.8.1",
     "tsup": "8.5.1",
     "tsx": "4.21.0",

packages/foundry-ai/project.json

@@ -22,7 +22,7 @@
     "lint": {
       "executor": "nx:run-commands",
       "options": {
-        "command": "pnpm exec biome check package.json nx.json tsconfig.base.json tsconfig.json pnpm-workspace.yaml biome.json AGENTS.md README.md docs/SPEC.md opencode.jsonc examples scripts packages/foundry-ai/package.json packages/foundry-ai/project.json packages/foundry-ai/src packages/foundry-ai/tsconfig.json packages/foundry-ai/tsconfig.lib.json packages/foundry-ai/tsconfig.test.json packages/foundry-ai/tsconfig.typecheck.json packages/foundry-ai/tsup.config.ts packages/foundry-ai/vitest.config.ts packages/foundry-ai/vitest.live.config.ts",
+        "command": "pnpm exec biome check .github AGENTS.md README.md SECURITY.md biome.json docs examples justfile nx.json opencode.jsonc package.json packages/foundry-ai pnpm-workspace.yaml scripts tsconfig.base.json tsconfig.json",
         "cwd": "{workspaceRoot}"
       }
     },