ci: add Fallow pull request audits

.fallowrc.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "./node_modules/fallow/schema.json",
+  "entry": ["src/index.ts", "src/gitlab/index.ts", "src/azure/index.ts"]
+}

.github/workflows/fallow.yml

@@ -0,0 +1,38 @@
+name: Fallow
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fallow-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: write
+      checks: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Vite+ and install dependencies
+        uses: ./
+        with:
+          node-version-file: .node-version
+
+      - name: Audit pull request
+        uses: fallow-rs/fallow@fccff887da0d83db1711379e0a3696dfc2460fdd # v3.33.1
+        with:
+          command: audit
+          # Fork and Dependabot PRs keep annotations and the job summary.
+          comment: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]' }}
+          branded-token: false

.gitignore

@@ -1,2 +1,3 @@
 node_modules/
 .vitest/
+.fallow/

CONTRIBUTING.md

@@ -43,6 +43,18 @@ Commit generated changes under `dist/` with the source changes. Include `dist/in
 
 The [pre-commit hook](.vite-hooks/pre-commit) runs `vp staged`. The staged-file configuration in [vite.config.ts](vite.config.ts) runs `vp check --fix` on staged files. Run the build yourself; the hook does not rebuild the bundles.
 
+### Pull Request Analysis
+
+The [Fallow workflow](.github/workflows/fallow.yml) runs `fallow audit` on pull requests. It checks changed files for unused code, complexity, duplication, and styling issues. Only new findings can fail the check; existing findings do not block adoption.
+
+The action uses the exact `fallow` version in `package.json`. After `vp install`, run the same analysis locally:
+
+```bash
+vp exec fallow audit --base origin/main
+```
+
+[`.fallowrc.json`](.fallowrc.json) declares the three runtime entry points. Fallow excludes generated files under `dist/` by default. Same-repository pull requests receive a result comment. Fork and Dependabot pull requests use annotations and the job summary.
+
 ## Integration Design
 
 Use the shared primitives under [`src/ci/`](src/ci/) for portable runtime behavior.

package.json

@@ -22,6 +22,7 @@
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
+    "fallow": "3.33.1",
     "typescript": "^7.0.0",
     "vite": "catalog:",
     "vite-plus": "catalog:"