fix(ci): nightly-E2E gruen + Dependabot + Action-Versionen bumpen (#13)

Die nightly-E2E (e2e.yml) war seit Erstellung bei JEDEM Lauf rot
(17 passed / 12 failed). Zwei Ursachen behoben:

- Onboarding-Welcome-Modal-Overlay fing Klicks ab (Reset-All, Slider,
  Masken, Logout) -> 30s-Timeouts in editor/login/screenshots.spec.
  Fix: beforeEach setzt `lumen.onboarding.v1=dismissed` + clearCookies,
  analog zu admin/feedback.spec.
- Marketplace-Seed lud ein PNG hoch, Backend verlangt fuer oeffentliche
  Preset-Previews aber JPEG (presets.py) + prueft Magic-Bytes
  (images.py) -> 400/415. Fix: uploadTinyImage nutzt jetzt ein valides
  1x1-JPEG (image/jpeg, ff d8 ff ...).

Zusaetzlich:
- screenshots.spec ist ein Doku-Generator, kein CI-Test -> hinter
  LUMEN_SCREENSHOTS=1 gegated (skippt im nightly).
- playwright.config: html-Reporter ergaenzt, damit der Artifact-Upload
  (frontend/playwright-report/) tatsaechlich Inhalt hat.
- .github/dependabot.yml: npm (frontend), pip (backend), github-actions
  -- woechentlich, minor+patch gruppiert.
- Action-Versionen gebumpt (Node-20-Deprecation): checkout v5,
  setup-node v6, setup-python v6, pnpm/action-setup v6,
  upload-artifact v5.

Co-authored-by: Manuel Rödig <m.roedig@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

.github/dependabot.yml

@@ -0,0 +1,61 @@
+# Dependabot: automatische Dependency-Update-PRs fuer alle drei Ecosystems.
+# Security-Alerts muessen zusaetzlich im Repo-Setting aktiviert werden
+# (Settings -> Code security -> Dependabot alerts) — die config hier deckt
+# nur die Version-Updates ab.
+#
+# Gruppierung: minor+patch werden pro Ecosystem in EINEN PR gebuendelt
+# (weniger Rauschen), major-Bumps kommen einzeln (potenziell breaking).
+version: 2
+updates:
+  # Frontend (React/Vite/TS) — pnpm-Lockfile in frontend/
+  - package-ecosystem: npm
+    directory: /frontend
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Berlin
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+      prefix-development: "chore(deps-dev)"
+    groups:
+      frontend-minor-patch:
+        update-types:
+          - minor
+          - patch
+
+  # Backend (FastAPI/SQLAlchemy) — requirements.txt + requirements-dev.txt
+  - package-ecosystem: pip
+    directory: /backend
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Berlin
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+      prefix-development: "chore(deps-dev)"
+    groups:
+      backend-minor-patch:
+        update-types:
+          - minor
+          - patch
+
+  # GitHub Actions in .github/workflows/
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Berlin
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "ci(deps)"
+    groups:
+      actions-all:
+        update-types:
+          - minor
+          - patch

.github/workflows/ci.yml

@@ -26,15 +26,15 @@ jobs:
       run:
         working-directory: frontend
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           version: 9
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: pnpm
@@ -65,10 +65,10 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 

.github/workflows/e2e.yml

@@ -19,7 +19,7 @@ jobs:
     name: Playwright E2E
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Dev-Stack hochfahren (PG + Keycloak + MinIO)
         run: docker compose -f deployment/docker-compose.dev.yml up -d
@@ -35,7 +35,7 @@ jobs:
           echo "Keycloak nicht ready"; docker compose -f deployment/docker-compose.dev.yml logs keycloak; exit 1
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
@@ -72,12 +72,12 @@ jobs:
           echo "Backend nicht ready"; cat backend.log; exit 1
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           version: 9
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: pnpm
@@ -116,7 +116,7 @@ jobs:
 
       - name: Playwright-Report als Artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: playwright-report
           path: frontend/playwright-report/

frontend/e2e/api-helper.ts

@@ -31,19 +31,69 @@ async function api<T>(token: string, path: string, init: FetchInit = {}): Promis
   return (await res.json()) as T;
 }
 
-/** Minimales 1x1 PNG (stat. Daten) — gross genug, dass HEAD eine Size meldet. */
-const TINY_PNG_BYTES = new Uint8Array([
-  0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d,
-  0x49, 0x48, 0x44, 0x52, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01,
-  0x08, 0x06, 0x00, 0x00, 0x00, 0x1f, 0x15, 0xc4, 0x89, 0x00, 0x00, 0x00,
-  0x0d, 0x49, 0x44, 0x41, 0x54, 0x78, 0x9c, 0x63, 0xfa, 0xcf, 0xc0, 0xc0,
-  0xc0, 0x00, 0x00, 0x00, 0x05, 0x00, 0x01, 0x95, 0x90, 0xf4, 0x97, 0x00,
-  0x00, 0x00, 0x00, 0x49, 0x45, 0x4e, 0x44, 0xae, 0x42, 0x60, 0x82,
+// Minimales valides 1x1 JPEG. MUSS ein JPEG sein: oeffentliche Preset-
+// Previews verlangen content_type image/jpeg (presets.py), und confirm_upload
+// prueft die echten Magic-Bytes (\xff\xd8\xff) gegen den deklarierten Typ
+// (images.py). Ein PNG wuerde hier mit 400 bzw. 415 abgelehnt.
+const TINY_JPEG_BYTES = new Uint8Array([
+  0xff, 0xd8, 0xff, 0xe0, 0x00, 0x10, 0x4a, 0x46, 0x49, 0x46, 0x00, 0x01,
+  0x01, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0xff, 0xdb, 0x00, 0x43,
+  0x00, 0x0a, 0x07, 0x07, 0x08, 0x07, 0x06, 0x0a, 0x08, 0x08, 0x08, 0x0b,
+  0x0a, 0x0a, 0x0b, 0x0e, 0x18, 0x10, 0x0e, 0x0d, 0x0d, 0x0e, 0x1d, 0x15,
+  0x16, 0x11, 0x18, 0x23, 0x1f, 0x25, 0x24, 0x22, 0x1f, 0x22, 0x21, 0x26,
+  0x2b, 0x37, 0x2f, 0x26, 0x29, 0x34, 0x29, 0x21, 0x22, 0x30, 0x41, 0x31,
+  0x34, 0x39, 0x3b, 0x3e, 0x3e, 0x3e, 0x25, 0x2e, 0x44, 0x49, 0x43, 0x3c,
+  0x48, 0x37, 0x3d, 0x3e, 0x3b, 0xff, 0xdb, 0x00, 0x43, 0x01, 0x0a, 0x0b,
+  0x0b, 0x0e, 0x0d, 0x0e, 0x1c, 0x10, 0x10, 0x1c, 0x3b, 0x28, 0x22, 0x28,
+  0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b,
+  0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b,
+  0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b,
+  0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b,
+  0x3b, 0x3b, 0xff, 0xc0, 0x00, 0x11, 0x08, 0x00, 0x01, 0x00, 0x01, 0x03,
+  0x01, 0x22, 0x00, 0x02, 0x11, 0x01, 0x03, 0x11, 0x01, 0xff, 0xc4, 0x00,
+  0x1f, 0x00, 0x00, 0x01, 0x05, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
+  0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0xff, 0xc4, 0x00, 0xb5, 0x10, 0x00,
+  0x02, 0x01, 0x03, 0x03, 0x02, 0x04, 0x03, 0x05, 0x05, 0x04, 0x04, 0x00,
+  0x00, 0x01, 0x7d, 0x01, 0x02, 0x03, 0x00, 0x04, 0x11, 0x05, 0x12, 0x21,
+  0x31, 0x41, 0x06, 0x13, 0x51, 0x61, 0x07, 0x22, 0x71, 0x14, 0x32, 0x81,
+  0x91, 0xa1, 0x08, 0x23, 0x42, 0xb1, 0xc1, 0x15, 0x52, 0xd1, 0xf0, 0x24,
+  0x33, 0x62, 0x72, 0x82, 0x09, 0x0a, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x25,
+  0x26, 0x27, 0x28, 0x29, 0x2a, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a,
+  0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x53, 0x54, 0x55, 0x56,
+  0x57, 0x58, 0x59, 0x5a, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a,
+  0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x83, 0x84, 0x85, 0x86,
+  0x87, 0x88, 0x89, 0x8a, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99,
+  0x9a, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xb2, 0xb3,
+  0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6,
+  0xc7, 0xc8, 0xc9, 0xca, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, 0xd8, 0xd9,
+  0xda, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xf1,
+  0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xff, 0xc4, 0x00,
+  0x1f, 0x01, 0x00, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
+  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
+  0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0xff, 0xc4, 0x00, 0xb5, 0x11, 0x00,
+  0x02, 0x01, 0x02, 0x04, 0x04, 0x03, 0x04, 0x07, 0x05, 0x04, 0x04, 0x00,
+  0x01, 0x02, 0x77, 0x00, 0x01, 0x02, 0x03, 0x11, 0x04, 0x05, 0x21, 0x31,
+  0x06, 0x12, 0x41, 0x51, 0x07, 0x61, 0x71, 0x13, 0x22, 0x32, 0x81, 0x08,
+  0x14, 0x42, 0x91, 0xa1, 0xb1, 0xc1, 0x09, 0x23, 0x33, 0x52, 0xf0, 0x15,
+  0x62, 0x72, 0xd1, 0x0a, 0x16, 0x24, 0x34, 0xe1, 0x25, 0xf1, 0x17, 0x18,
+  0x19, 0x1a, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x35, 0x36, 0x37, 0x38, 0x39,
+  0x3a, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x53, 0x54, 0x55,
+  0x56, 0x57, 0x58, 0x59, 0x5a, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69,
+  0x6a, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x82, 0x83, 0x84,
+  0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97,
+  0x98, 0x99, 0x9a, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa,
+  0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xc2, 0xc3, 0xc4,
+  0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7,
+  0xd8, 0xd9, 0xda, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea,
+  0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xff, 0xda, 0x00,
+  0x0c, 0x03, 0x01, 0x00, 0x02, 0x11, 0x03, 0x11, 0x00, 0x3f, 0x00, 0x4a,
+  0x28, 0xa2, 0x80, 0x3f, 0xff, 0xd9,
 ]);
 
 export async function uploadTinyImage(
   token: string,
-  filename = "marketplace-preview.png",
+  filename = "marketplace-preview.jpg",
 ): Promise<{ id: string }> {
   // Snake-Case-Body: dev backend kann beide Formen, alte Backends nur snake.
   const init = await api<{ id?: string; upload_url?: string; uploadUrl?: string }>(
@@ -53,8 +103,8 @@ export async function uploadTinyImage(
       method: "POST",
       body: JSON.stringify({
         filename,
-        content_type: "image/png",
-        size_bytes: TINY_PNG_BYTES.byteLength,
+        content_type: "image/jpeg",
+        size_bytes: TINY_JPEG_BYTES.byteLength,
       }),
     },
   );
@@ -66,8 +116,8 @@ export async function uploadTinyImage(
   // PUT direkt gegen den Pre-Signed URL (MinIO/Garage).
   const put = await fetch(uploadUrl, {
     method: "PUT",
-    headers: { "Content-Type": "image/png" },
-    body: TINY_PNG_BYTES,
+    headers: { "Content-Type": "image/jpeg" },
+    body: TINY_JPEG_BYTES,
   });
   if (!put.ok) {
     throw new Error(`Pre-Signed-PUT fehlgeschlagen: ${put.status}`);

frontend/e2e/editor.spec.ts

@@ -10,6 +10,20 @@ const SAMPLE_DIR = join(HERE, "..", "..", "tests-fixtures", "test-samples");
 const JPG_PATH = join(SAMPLE_DIR, "gradient.jpg");
 const PNG_PATH = join(SAMPLE_DIR, "gradient.png");
 
+// Onboarding auf "dismissed" vorsetzen: ein frischer Test-User triggert sonst
+// das Welcome-Modal beim ersten /editor-Render, dessen Overlay alle Klicks
+// (Reset-All, Slider, Masken-Toggles) abfaengt -> 30s-Timeouts. Cookies leeren
+// gegen KC-Session-Leak zwischen Tests. Gleiches Muster wie admin/feedback.spec.
+test.beforeEach(async ({ page, context }) => {
+  await context.clearCookies();
+  await page.addInitScript(() => {
+    window.localStorage.setItem(
+      "lumen.onboarding.v1",
+      JSON.stringify({ status: "dismissed" }),
+    );
+  });
+});
+
 test.describe("Editor", () => {
   test("JPG laden, Bypass-Toggle, Reset-All", async ({ page }) => {
     const user = await loginAsNewUser(page);

frontend/e2e/login.spec.ts

@@ -2,6 +2,19 @@ import { test, expect } from "@playwright/test";
 
 import { cleanupUser, loginAsNewUser } from "./auth-helper";
 
+// Cookies leeren (KC-Session-Leak zwischen Tests) + Onboarding "dismissed":
+// nach dem Login landet man im Editor, dessen Welcome-Modal sonst den
+// Logout-Button-Klick abfaengt -> 30s-Timeout. Gleiches Muster wie admin.spec.
+test.beforeEach(async ({ page, context }) => {
+  await context.clearCookies();
+  await page.addInitScript(() => {
+    window.localStorage.setItem(
+      "lumen.onboarding.v1",
+      JSON.stringify({ status: "dismissed" }),
+    );
+  });
+});
+
 test.describe("Login-Flow gegen Keycloak", () => {
   test("ohne Login: /editor redirected auf /login", async ({ page }) => {
     await page.goto("/editor");

frontend/e2e/marketplace.spec.ts

@@ -15,6 +15,19 @@ import { apiTokenFor, cleanupUser, loginAsNewUser } from "./auth-helper";
  * den Component-Tests (vitest) abgedeckt und wuerde im E2E-Setup
  * mehrere Sekunden plus Bilddatei-Auswahl kosten.
  */
+// Onboarding "dismissed" vorsetzen + Cookies leeren: sonst blockiert das
+// Welcome-Modal den Logout-Klick (Creator->Consumer-Wechsel) und KC-Sessions
+// leaken zwischen Tests. Gleiches Muster wie admin/feedback.spec.
+test.beforeEach(async ({ page, context }) => {
+  await context.clearCookies();
+  await page.addInitScript(() => {
+    window.localStorage.setItem(
+      "lumen.onboarding.v1",
+      JSON.stringify({ status: "dismissed" }),
+    );
+  });
+});
+
 test.describe("Marketplace", () => {
   test("Empty-State sichtbar wenn keine Presets veroeffentlicht", async ({
     page,

frontend/e2e/screenshots.spec.ts

@@ -17,7 +17,26 @@ const SHOTS = join(HERE, "..", "..", "docs", "screenshots", "phase5");
 
 test.use({ viewport: { width: 1440, height: 900 } });
 
+// Doku-Screenshots sind kein CI-Test (siehe Header): nur explizit via
+// LUMEN_SCREENSHOTS=1 ausfuehren. Im nightly-Lauf wird der Test geskippt,
+// damit die fragile Doku-Sequenz (Preset speichern/anwenden, Masken) die
+// Suite nicht rot faerbt.
+const RUN_SCREENSHOTS = Boolean(process.env.LUMEN_SCREENSHOTS);
+
+// Onboarding "dismissed" vorsetzen, damit das Welcome-Modal beim explizit
+// gestarteten Lauf nicht die Editor-Klicks blockiert.
+test.beforeEach(async ({ page, context }) => {
+  await context.clearCookies();
+  await page.addInitScript(() => {
+    window.localStorage.setItem(
+      "lumen.onboarding.v1",
+      JSON.stringify({ status: "dismissed" }),
+    );
+  });
+});
+
 test("UI-Screenshots: Editor-Hauptzustaende fuer Phase-5-Doku", async ({ page }) => {
+  test.skip(!RUN_SCREENSHOTS, "Doku-Screenshots nur via LUMEN_SCREENSHOTS=1");
   const user = await loginAsNewUser(page);
   try {
     await page.goto("/editor");

frontend/playwright.config.ts

@@ -13,7 +13,10 @@ export default defineConfig({
   fullyParallel: false,
   retries: process.env.CI ? 2 : 0,
   workers: 1,
-  reporter: [["list"]],
+  // list = lesbare Konsolen-Ausgabe; html = durchsuchbarer Report mit
+  // eingebetteten Traces/Screenshots, der im nightly-Workflow als Artifact
+  // hochgeladen wird (sonst existiert kein playwright-report/-Verzeichnis).
+  reporter: [["list"], ["html", { open: "never" }]],
   use: {
     baseURL: BASE_URL,
     trace: "retain-on-failure",