ci: run quality-gate checks on Cursor Origin Codebase

[nikomatt69]

Issue for this PR

N/A — Origin-hosted CI for Cursor Codebase.

Type of change

• New feature

What does this PR do?

This repo is currently a GitHub inbound mirror, so GitHub Actions stay the runner and Origin PRs are unavailable until the repo is detached.

Cursor Codebase CI (Depot/Buildkite) only runs on Origin-hosted repos. This change:

• Adds Depot quality-gate workflows under .depot/ (validate, typecheck, test, generate, nix-eval, storybook, security)
• Lets autofix / report / review / /autofix run on nikoemme/nikcli as well as nikomatt69/nikcli
• Updates script/ci-autofix.ts so Origin is not treated as the wrong repository
• Keeps publish, desktop, Railway, and Windows jobs GitHub-only

After merge, to actually run CI on cursor.com/codebase:

1. Repo Settings → Detach from GitHub (Danger Zone), so Origin becomes the source of truth
2. Codebase Apps → connect Depot

How did you verify your code works?

bun test test/release/ci-coherence.test.ts test/release/ci-integration.test.ts test/release/ci-targeted.test.ts test/release/automation.test.ts — all passing.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/security.yml

Package	Version	License	Issue Type
actions/checkout	7.*.*	Null	Unknown License

Allowed Licenses:

MIT, Apache-2.0, ISC, BSD-2-Clause, BSD-3-Clause, CC0-1.0, Unlicense, 0BSD

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	7.*.*	🟢 7	Details Check Score Reason Maintained 🟢 10 24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches

Scanned Files

• .github/workflows/security.yml

[github-actions]

This Depot test workflow is Linux-only (the matrix has a single linux entry and runs on depot-ubuntu-24.04-8), but the Set OS-specific paths step still carries the full Windows branch copied from .github/workflows/test.yml (backslashes, ${{ runner.temp }}\\nikcli-e2e, etc.). That branch is dead code on Depot runners and adds ~35 lines of noise. Since the goal stated in the PR is to keep Depot Linux-only, this whole if/else can collapse to just the else branch. Suggestion: remove lines 42-58 (the Windows if block) and unindent the Linux branch to sit directly under run: |. Only an actual suggestion — feel free to leave it as-is if you intentionally want byte-for-byte parity with the GitHub copy for diffability.