test(lab-ops-hub): wire both crawl-validator suites into npm test and CI

.github/workflows/lab-ops-hub.yml

@@ -0,0 +1,66 @@
+name: lab-ops-hub
+
+# Test verification for pkgs/lab-ops-hub (#470).
+#
+# The package's two crawl-validator suites — the TypeScript suite for the
+# Worker copy of validateCrawlUrl (test/lib.test.ts) and the Python suite
+# for the container copy (test/test_container_validate.py, added by #469)
+# — were run by nothing: `npm test` matched only the TypeScript files and
+# no workflow mentioned the package at all, so the checks that ran on the
+# crawl-fix PRs (#441, #460, #464, #466, #468) were treefmt / flake eval
+# only. The validators are the SSRF guard for a publicly reachable
+# crawler, implemented twice with a documented "same policy" contract;
+# this workflow runs the single documented command (`npm test`, which
+# runs both suites and fails if either fails) on every change to the
+# package so a divergence is caught before merge.
+#
+# Neither suite needs the package's dependencies installed: the
+# TypeScript tests import only src/lib.ts (pure helpers, no Worker
+# bindings) and the Python tests use the stdlib only, so there is
+# deliberately no `npm install` step.
+
+on:
+  pull_request:
+    paths:
+      - "pkgs/lab-ops-hub/**"
+      - ".github/workflows/lab-ops-hub.yml"
+  push:
+    branches: [main]
+    paths:
+      - "pkgs/lab-ops-hub/**"
+      - ".github/workflows/lab-ops-hub.yml"
+
+permissions:
+  contents: read
+
+# Push-to-main runs each get their own group (keyed by run_id), so a
+# later merge can never cancel — or displace a pending — verification
+# run for an earlier merge: every merged tree gets its own completed
+# run. Pull-request runs keep sharing a per-ref group, so a new push
+# to a PR still supersedes its stale run (#392).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.run_id || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Run both crawl-validator suites
+        working-directory: pkgs/lab-ops-hub
+        run: npm test

pkgs/lab-ops-hub/README.md

@@ -62,6 +62,20 @@ rebinding) is not re-checked.
 - `POST /api/crawl {url}` — container crawl (or `{"via":"worker"}` to force fallback), full text archived to R2
 - `GET /api/crawls`
 
+## Testing
+
+```bash
+npm test   # from pkgs/lab-ops-hub — runs BOTH suites, fails if either fails
+```
+
+That one command runs the TypeScript suite (`test/lib.test.ts`, the
+Worker copy of the crawl validator) and the Python suite
+(`test/test_container_validate.py`, the container copy) — the two
+implementations share one SSRF policy, so both are pinned together.
+Neither suite needs `npm install` (pure helpers / stdlib only). CI
+runs the same command on every pull request touching
+`pkgs/lab-ops-hub/**` (`.github/workflows/lab-ops-hub.yml`).
+
 ## Develop / deploy
 
 ```bash

pkgs/lab-ops-hub/package.json

@@ -14,7 +14,9 @@
     "db:init:local": "wrangler d1 execute labops-db --local --file=./schema.sql",
     "deploy": "wrangler deploy",
     "dev": "wrangler dev",
-    "test": "node --test \"test/**/*.test.ts\"",
+    "test": "npm run test:ts && npm run test:py",
+    "test:py": "python3 -m unittest discover -s test -p \"test_*.py\"",
+    "test:ts": "node --test \"test/**/*.test.ts\"",
     "types": "wrangler types"
   },
   "type": "module",