Add mirago to CI: Block Fake Imports on Every Pull Request

The best verification step is the one you never have to remember. Because mirago exits with code 1 on problems and 0 when clean, it slots straight into CI — failing the build the moment an AI-invented package sneaks in.

GitHub Actions

Drop this in .github/workflows/mirago.yml:

```yaml
name: mirago
on: [push, pull_request]

jobs:
check:
runs-on: ubuntu-latest
steps:

• • uses: actions/checkout@v4
  • uses: actions/setup-python@v5
    with:
    python-version: "3.12"
  • run: pipx install mirago
  • run: mirago check .
    ```

Now every push and pull request is scanned, and a hallucinated import turns the check red before anyone merges it.

Fail on warnings too

By default only errors (packages that don't exist) fail the build. To also fail on risky-but-real packages, opt in:

```bash
mirago check . --fail-on warning
```

Feed results to other tools

```bash
mirago check . --json > mirago-report.json
```

The JSON output carries the evidence behind each finding — see the usage reference.

Pre-commit, too

Catch issues even earlier by running mirago check on changed files in a pre-commit hook, so a fake import never even lands in a commit.

Note: if PyPI is unreachable during a CI run, mirago treats packages as fine rather than failing your pipeline on a network blip — see fail-open by design.