ci: run the doctor suite on pull requests

Its 82 tests only ran through the release workflow's prepack, so a regression
there surfaced while cutting a release rather than on the pull request that
caused it - the same gap the CLI had before its own test workflow existed.

No darwin leg: unlike the CLI suites these stub the platform through a fake
HostInfo rather than probing it, so a second OS would run identical
assertions.

The package's lockfile is now committed rather than ignored, which is what
lets CI use npm ci and cache by its hash. Without it installs were resolved
fresh on every run, so a transitive release could break the build with no
change to the repository.

Author: edusperoni

.github/workflows/tests.yml

@@ -54,3 +54,40 @@ jobs:
 
       - name: Test
         run: npm test
+
+  doctor:
+    name: Doctor (Node ${{ matrix.node-version }})
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # No darwin leg: unlike the CLI suites, these stub the platform through
+        # a fake HostInfo rather than probing it, so a second OS runs identical
+        # assertions.
+        node-version: [ '20.x', '22.x', '24.x' ]
+
+    steps:
+
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+          cache-dependency-path: packages/doctor/package-lock.json
+
+      - name: Install
+        working-directory: packages/doctor
+        run: npm ci
+
+      - name: Test
+        working-directory: packages/doctor
+        run: npm test

packages/doctor/.gitignore

@@ -26,7 +26,6 @@ build/Release
 # Dependency directories
 node_modules
 jspm_packages
-package-lock.json
 
 # Optional npm cache directory
 .npm