chore(ci): gate paybot-sdk on npm run lint + ignore coverage/ artifacts

[RBKunnela]

Summary

Closes #17 (promote npm run lint to a CI gate) and references #16 (coverage/ in .gitignore).

This was unblocked by Task #14 / PR #36 (Story 14 — dual-mode refactor), which eliminated the no-dupe-else-if real-bug lint failure on src/x402-v2.ts:251. Lint now passes clean on main, so we can promote it from local-only convention to CI-enforced gate.

Why lint gate matters

paybot-sdk auto-publishes to npm on push to main (see publish: job in .github/workflows/ci.yml). Without an enforced lint step in the build: job that gates the publish job, a future lint regression could ship straight to the npm registry. Promoting npm run lint to a CI step closes that exposure.

What changed

.github/workflows/ci.yml — added a Lint step in the build: matrix job, positioned between Install dependencies (npm ci) and Type check (npm run type-check). Fast-fail ordering: lint runs first, type-check second, tests third, coverage fourth, build last. A lint failure halts the matrix entry before any downstream step burns CI minutes.

Indentation matches the other matrix steps. No changes to package.json (the lint script already exists and is wired to eslint src --ext .ts).

Task #16 — coverage/ in .gitignore

Pre-existing. Already present on line 12 of .gitignore (added during the original repo setup, long before the Story 15 coverage gate). No-op — not included in this PR. Bookkeeping confirms #16 was already satisfied; closing the issue without a code change.

Chain governance

9th application of automated-pr-merge-authority.md (NON-NEGOTIABLE rule, established 2026-05-22). This PR uses the chore-style carve-out: no story, no acceptance criteria, no application code — pure CI/hygiene. Chain executes as:

Phase	Status
@sm draft	N/A (chore carve-out)
@po validation	N/A (chore carve-out)
@dev implementation	@devops authored (CI scope)
@qa 12-check	required before merge
@devops merge	only @devops, per pre-approval pattern on @qa PASS

Anti-patterns avoided

• AP Founding 10 Contributors Program — Support Open Agent Commerce #4 — Verbatim check context names: To be captured post-CI from gh pr checks and reported back. Hypothesis (per Story 15 PR feat(coverage): enable 80% coverage gate via 28+ new tests (Story 15) #38 precedent): lint runs inside the build (18) / build (20) matrix entries, so the existing 4 required_status_checks contexts remain unchanged. If a new context name surfaces, post-merge required_status_checks PATCH will be documented.

Out of scope

• Extending lint scope beyond src/ (e.g., tests, scripts) — separate task
• Prettier integration into CI — separate task
• Lint rule audit / ruleset tightening — separate task

Pre-merge verification (local)

• npm run lint on main @ 553cabf: PASS (zero warnings, zero errors)
• Lint config: eslint src --ext .ts (per package.json)

🤖 Generated with Claude Code

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Review limit reached

@RBKunnela, we couldn't start this review because you've used your available PR reviews for now.

Your plan currently allows 1 review/hour. Refill in 21 minutes and 46 seconds.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more review capacity refills, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d015599e-fb95-40c8-978d-6180f62ba64b

📥 Commits

Reviewing files that changed from the base of the PR and between 553cabf and c2c67bc.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/gitignore-coverage-and-lint-gate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[RBKunnela]

Merge authorization per .claude/rules/automated-pr-merge-authority.md (9th application — final chore PR of the day):

• @sm/@po/@dev: SKIP (chore-style CI infra)
• @qa: PASS — 2 passes, 12/12 adapted checks
  • 4/4 required CI green
  • Lint enforced inside build (18)/build (20) matrix
  • No new required_status_checks contexts (AP Founding 10 Contributors Program — Support Open Agent Commerce #4 hypothesis confirmed)
  • Task ci(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.2.1 to 2.3.8 #16 no-op verified (.gitignore line 12 had coverage/ already)
  • Task ci(deps): bump actions/checkout from 4 to 6 #17 lint gate landed (ci.yml +3/-0)
• @aiox-master (Orion): Chain routing approved
• @devops: Executing merge under operator pre-approval pattern

Closes Task #16 (no code change — verified pre-existing) + Task #17 (lint gate enforced in CI).

This is the 11th paybot ecosystem merge today (9th application of automated-pr-merge-authority rule).