Add GitHub Actions CI for lint, typing, and tests

ci.yml runs on every push to main and every PR: lint + typing on 3.12,
and unit tests across Python 3.10/3.13. integration.yml runs the live
Diffbot suite nightly and on-demand using the DIFFBOT_API_TOKEN secret.

CI installs with `uv sync --no-sources` so langchain-core / langchain-tests
resolve from PyPI (the sibling ../langchain checkout in [tool.uv.sources]
only exists locally), and sets UV_NO_SYNC so the make targets reuse the
synced env.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: shixish

.github/workflows/ci.yml

@@ -0,0 +1,57 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  # `[tool.uv.sources]` pins langchain-core / langchain-tests to a sibling
+  # `../langchain/` checkout that does not exist on CI. `--no-sources` ignores
+  # that table and resolves them from PyPI instead — the same path release
+  # builds take. It forces re-resolution, so the lockfile is not used here.
+  UV_NO_SYNC: "true"
+
+jobs:
+  lint:
+    name: lint + typing
+    runs-on: ubuntu-latest
+    env:
+      RUFF_OUTPUT_FORMAT: github
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          version: "0.9.5"
+          python-version: "3.12"
+          enable-cache: true
+      - run: uv sync --no-sources --group lint --group typing
+      - run: make lint
+      - run: make typing
+
+  test:
+    name: unit tests (py${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          version: "0.9.5"
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+      - run: uv sync --no-sources --group test
+      - run: make test
+      - name: Check for unexpected file changes
+        run: git diff --exit-code

.github/workflows/integration.yml

@@ -0,0 +1,32 @@
+name: Integration
+
+# Hits the live Diffbot APIs, so it consumes real quota and needs a token.
+# Kept off the per-PR path: nightly + on-demand only. Neither trigger can be
+# invoked by a fork PR, so the repo-level DIFFBOT_API_TOKEN secret is never
+# exposed to untrusted code.
+on:
+  schedule:
+    - cron: "0 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  UV_NO_SYNC: "true"
+
+jobs:
+  integration:
+    name: integration tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          version: "0.9.5"
+          python-version: "3.12"
+          enable-cache: true
+      - run: uv sync --no-sources --group test
+      - run: make test_integration
+        env:
+          DIFFBOT_API_TOKEN: ${{ secrets.DIFFBOT_API_TOKEN }}

CLAUDE.md

@@ -61,6 +61,12 @@ make test            # unit tests
 make test_integration  # integration tests (needs DIFFBOT_API_TOKEN)
 ```
 
+## Continuous integration
+
+`.github/workflows/ci.yml` runs on every push to `main` and every PR: `make lint` + `make typing` (Python 3.12) and `make test` (Python 3.10 and 3.13). `.github/workflows/integration.yml` runs `make test_integration` nightly and on-demand (`workflow_dispatch`), reading the repo-level `DIFFBOT_API_TOKEN` secret. It is kept off the per-PR path on purpose: neither `schedule` nor `workflow_dispatch` can be triggered by a fork PR, so the token is never exposed to untrusted code.
+
+CI cannot use the `[tool.uv.sources]` table, which pins `langchain-core` / `langchain-tests` to the sibling `../langchain/` checkout that only exists locally. Every CI install is `uv sync --no-sources` (resolves those from PyPI, the same path release builds take) and sets `UV_NO_SYNC=true` so the `make` targets' `uv run` reuse the synced env instead of re-resolving against the sources table. `--no-sources` re-resolves, so `uv.lock` is not used in CI.
+
 ## Releasing
 
 PyPI / TestPyPI tokens live in the macOS Keychain so the Makefile pulls them automatically — no plaintext on disk, no shell-history leaks. First-time (or post-rotation) setup:

README.md

@@ -1,5 +1,7 @@
 # langchain-diffbot
 
+[![CI](https://github.com/diffbot/langchain-diffbot/actions/workflows/ci.yml/badge.svg)](https://github.com/diffbot/langchain-diffbot/actions/workflows/ci.yml)
+
 A thin LangChain integration over the official [`diffbot-python`](https://github.com/diffbot/diffbot-python) SDK. Every Diffbot API gets the closest LangChain primitive:
 
 | Diffbot API | LangChain class(es) |