Standardize project verification workflow

.github/workflows/ci.yml

@@ -32,11 +32,5 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Check syntax
-        run: node --check server.js && node --check lib/safe-fetch.js
-
-      - name: Run tests
-        run: pnpm test
-
-      - name: Audit production dependencies
-        run: pnpm audit --prod --audit-level=high
+      - name: Verify project
+        run: pnpm verify

AGENTS.md

@@ -0,0 +1,9 @@
+# Repository workflow
+
+- Use pnpm only. Do not run `npm install` against this workspace.
+- Use Node.js 20.18.1 or newer.
+- Run `pnpm verify` before publishing a pull request.
+- Keep raw extracted metadata separate from sanitized or fallback display values when calculating audit results.
+- For UI changes, inspect desktop and 390x844 layouts, missing-image behavior, and browser console errors.
+- Before reviewing or creating a pull request, fetch the default branch and review the complete `origin/master...HEAD` diff.
+- For outbound-fetch changes, verify redirect and DNS SSRF handling, proxy trust, request bounds, and safe public errors.

README.md

@@ -71,6 +71,12 @@ TRUST_PROXY_HOPS=1 pnpm start
 pnpm test
 ```
 
+Before publishing a pull request, run the same syntax, test, and production dependency checks used by CI:
+
+```bash
+pnpm verify
+```
+
 The test suite covers:
 
 - Private-network and DNS-based SSRF rejection

package.json

@@ -4,8 +4,11 @@
   "description": "A Node.js application that performs a basic SEO audit and displays social media previews based on a website's meta tags.",
   "main": "server.js",
   "scripts": {
+    "check:syntax": "node --check server.js && node --check lib/safe-fetch.js",
     "start": "node server.js",
-    "test": "node --test"
+    "test": "node --test",
+    "test:ui": "node --test test/app.test.js",
+    "verify": "pnpm run check:syntax && pnpm test && pnpm audit --prod --audit-level=high"
   },
   "packageManager": "pnpm@10.33.0",
   "engines": {