Merge pull request #1 from VaiYav/chore/dependency-updates #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Audit D1: a green CI must actually run the FULL backend suite. Before this | |
| # workflow the repo had no CI at all, which is how 11 broken full-AppModule spec | |
| # files (esbuild paramtypes drift) shipped undetected. This job runs the whole | |
| # layered backend suite (unit + integration + system + acceptance + e2e) on | |
| # every push to a main branch and every PR. | |
| on: | |
| push: | |
| branches: [main, master, develop] | |
| pull_request: | |
| # A newer push to the same ref cancels the in-flight run. | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| backend: | |
| name: Lint + backend test suite | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 11 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.19.0 | |
| cache: pnpm | |
| - name: Install dependencies | |
| # Backend `postinstall` runs `prisma generate` (schema-only, no DB | |
| # connection needed). The Camoufox browser is NOT downloaded on install: | |
| # camoufox-js is absent from pnpm-workspace `allowBuilds`, so pnpm blocks | |
| # its postinstall — tests mock the browser anyway. | |
| run: pnpm install --frozen-lockfile | |
| - name: Build @spa/shared | |
| # The backend imports the `@spa/shared` package, which resolves through | |
| # the workspace symlink to its built `dist/` (there is deliberately no | |
| # vitest source alias for `@spa/shared`). The dist must exist before any | |
| # test or lint runs. | |
| run: pnpm --filter @spa/shared build | |
| - name: Validate planning documents | |
| run: pnpm planning:check | |
| - name: Lint (oxlint) | |
| run: pnpm lint | |
| - name: Check for residual astrology/branding leaks | |
| # Gate intent: the open-source repo stays domain-agnostic — no vertical | |
| # (astrology/brand) content may leak into prompts, defaults or copy. | |
| # | |
| # Sanctioned carve-outs (each deliberate architecture, not leakage): | |
| # - src/generated/** → build artifact; regenerate, never hand-edit. | |
| # - ZODIAC_* / zodiac-back / my-zodiac-ai.com / attribution-links / | |
| # infrastructure/link + modules/link-attribution + link.port + | |
| # cta-attribution + source-url.util | |
| # → ADR-007 external attribution client: the | |
| # provider's name IS the contract surface. | |
| # Any hit outside these tokens is a real leak and fails the build. | |
| run: | | |
| pattern='my.?zodiac|my-zodiac|myzodiac|horoscope|astrolog|zodiac|natal chart|sun sign|moon sign' | |
| if grep -R -i -n -E "$pattern" packages/brand-voice.example.md README.md LICENSE CONTRIBUTING.md .env.example packages/backend/src packages/ui/src packages/shared/src 2>/dev/null \ | |
| | grep -v '/src/generated/' \ | |
| | grep -vi 'example' \ | |
| | grep -v -i -E 'ZODIAC_|zodiac-back|my-zodiac-ai\.com|attribution-links|infrastructure/link/|modules/link-attribution/|ports/link\.port|cta-attribution|source-url\.util' ; then | |
| echo "Residual My Zodiac AI / astrology references found" >&2 | |
| echo "If the hit is intentional integration surface, extend the carve-out" >&2 | |
| echo "list above WITH a pointer to its ADR/task — do not silence blindly." >&2 | |
| exit 1 | |
| fi | |
| - name: Typecheck (nest build) | |
| # esbuild-based vitest does NOT typecheck, so a type error can pass the | |
| # whole test suite while breaking `pnpm build` / `pnpm dry-run` (both run | |
| # nest build). This step is what would have caught the LocalhostGuard tsc | |
| # break. @spa/shared is already built above. | |
| run: pnpm --filter @spa/backend build | |
| - name: Backend test suite | |
| # `pnpm test` -> `vitest run` in @spa/backend = the full layered suite. | |
| # External I/O (Prisma, Redis, browser) is mocked, so no Postgres/Redis | |
| # services and no secrets are required. | |
| # | |
| # HARDEN-001/CI-001: run with `--coverage` so the thresholds configured in | |
| # vitest.config.mts (statements/functions/lines 80%, branches 75%) are | |
| # actually ENFORCED here — before this change a coverage regression could | |
| # pass CI silently because the thresholds were never evaluated. | |
| run: pnpm --filter @spa/backend test:coverage | |
| ui: | |
| name: UI typecheck + vitest suite | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 11 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.19.0 | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Typecheck (vue-tsc) | |
| # Mirrors the backend "vitest does not typecheck" rule: `vue-tsc --noEmit` | |
| # is what `pnpm build` runs, so it must pass on its own. | |
| run: pnpm --filter @spa/ui type-check | |
| - name: UI test suite | |
| # HARDEN-001/CI-001: the 24-file packages/ui suite (components, stores, | |
| # views, composables) never ran in CI before; jsdom-based, fully mocked, | |
| # no backend needed. Playwright e2e stays out of CI for now (needs | |
| # browsers + Vite dev server) — tracked as a follow-up. | |
| run: pnpm --filter @spa/ui test |