chore(ci): add automation workflows

Add CI, release, and self-test workflows with fixture configs.

Author: FS

.github/workflows/ci.yml

@@ -0,0 +1,28 @@
+name: ci
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run typecheck
+      - run: npm run coverage
+      - run: npm run build
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: coverage-report
+          path: coverage

.github/workflows/release.yml

@@ -0,0 +1,29 @@
+name: release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run typecheck
+      - run: npm run coverage
+      - run: npm run validate
+      - run: npm run build
+      - run: test -f action.yml
+      - uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true

.github/workflows/self-test.yml

@@ -0,0 +1,35 @@
+name: self-test
+
+on:
+  pull_request:
+
+jobs:
+  pass-case:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./
+        with:
+          github-token: ${{ github.token }}
+          config-path: tests/fixtures/self-test/pass.yml
+
+  fail-case:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@v4
+      - id: policy-gate
+        continue-on-error: true
+        uses: ./
+        with:
+          github-token: ${{ github.token }}
+          config-path: tests/fixtures/self-test/fail.yml
+      - if: steps.policy-gate.outcome != 'failure'
+        run: |
+          echo "Expected the failure fixture to fail."
+          exit 1

tests/fixtures/self-test/fail.yml

@@ -0,0 +1,7 @@
+policies:
+  - id: required-self-test-label
+    severity: error
+    require:
+      has_label:
+        - 'policy-gate-self-test-required-label'
+    message: 'This fixture intentionally fails unless the special self-test label exists.'

tests/fixtures/self-test/pass.yml

@@ -0,0 +1,13 @@
+policies:
+  - id: release-label-example
+    severity: warn
+    when:
+      changed:
+        - 'api/public/**'
+    require:
+      any:
+        - has_label:
+            - 'release-note-exempt'
+        - changed:
+            - 'CHANGELOG.md'
+    message: 'Public API changes should include release-note evidence.'