From 528cb50b83016d52f616eac67819efffaacc5575 Mon Sep 17 00:00:00 2001
From: Douglas Eichelberger <doug.eichelberger@gusto.com>
Date: Wed, 30 Sep 2026 13:16:37 -0700
Subject: [PATCH 1/2] Format GitHub config YAML with Prettier

.prettierrc sets singleQuote, which Prettier also applies to YAML, so
`prettier -c .` flagged the double-quoted strings in dependabot.yml,
codeql.yml and zizmor.yml, and `npm run lint` failed on main. CI never
ran lint, so it went unnoticed.

Quoting is the only change: each file parses to the same YAML as
before. The other workflows already use single quotes.
---
 .github/dependabot.yml       | 22 +++++++++++-----------
 .github/workflows/codeql.yml |  2 +-
 .github/workflows/zizmor.yml |  2 +-
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1161405..e6272a3 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,26 +1,26 @@
 version: 2
 updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: 'github-actions'
+    directory: '/'
     schedule:
-      interval: "monthly"
+      interval: 'monthly'
     groups:
       github-actions:
         patterns:
-          - "*"
+          - '*'
     cooldown:
       default-days: 7
-  - package-ecosystem: "npm"
-    directory: "/"
+  - package-ecosystem: 'npm'
+    directory: '/'
     schedule:
-      interval: "monthly"
-    versioning-strategy: "increase-if-necessary"
+      interval: 'monthly'
+    versioning-strategy: 'increase-if-necessary'
     groups:
       npm:
         patterns:
-          - "*"
+          - '*'
         update-types:
-          - "minor"
-          - "patch"
+          - 'minor'
+          - 'patch'
     cooldown:
       default-days: 7
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index fbb31af..0af1448 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,4 +1,4 @@
-name: "CodeQL"
+name: 'CodeQL'
 
 on:
   push:
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index e5a0721..18d5170 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -4,7 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: ["**"]
+    branches: ['**']
 
 permissions: {}
 

From deba08fec7089ef2e8ed3178ac7d101ee5dc588f Mon Sep 17 00:00:00 2001
From: Douglas Eichelberger <doug.eichelberger@gusto.com>
Date: Wed, 30 Sep 2026 13:16:38 -0700
Subject: [PATCH 2/2] Run lint in CI

The build job runs `npm run build:prod`, which, unlike `npm run build`,
has no prebuild hook, so neither ESLint nor Prettier ran in CI. Add a
lint job that runs `npm run lint` once on Ubuntu, since neither tool's
results depend on the OS.

It skips the build job's node_modules cache step: npm ci deletes
node_modules before installing, so that cache never takes effect.
---
 .github/workflows/build.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f90a9e9..ecc6f2b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -40,3 +40,17 @@ jobs:
       - run: npm ci
       - run: npm run build:prod
       - run: npm test
+
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Use Node.js 24
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+      - run: npm ci
+      - run: npm run lint