From a1cc177c3825e3a95fb4ca403b377b3c6ca31752 Mon Sep 17 00:00:00 2001 From: Wagner Lacerda Date: Sun, 18 Oct 2026 06:44:06 -0300 Subject: [PATCH 1/2] ci: bump checkout and setup-node to v6 to run natively on Node 24 --- .github/workflows/ci.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c3084a2..81e5df2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,8 +19,8 @@ jobs: name: Lint and type check runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v6 + - uses: actions/setup-node@v6 with: node-version: 22 - name: Install dependencies @@ -34,8 +34,8 @@ jobs: name: Unit and contract tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v6 + - uses: actions/setup-node@v6 with: node-version: 22 - name: Install dependencies @@ -47,8 +47,8 @@ jobs: name: Production build and end-to-end verification runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v6 + - uses: actions/setup-node@v6 with: node-version: 22 - name: Install dependencies From cb6730f8dd9bd125ea95e61b51d2abbddac27b26 Mon Sep 17 00:00:00 2001 From: Wagner Lacerda Date: Sun, 18 Oct 2026 06:44:29 -0300 Subject: [PATCH 2/2] docs: document the CI workflow and what its first run showed --- README.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index c9c411e..9e59617 100644 --- a/README.md +++ b/README.md @@ -148,14 +148,25 @@ PASS an unreachable API does not render bookmarks 40/40 checks passed ``` +## Continuous integration + +`.github/workflows/ci.yml` runs on every push and pull request to `main`, and can be started by hand from the Actions tab. It has three jobs that run in parallel on Node 22: + +| Job | Runs | +|---|---| +| Lint and type check | `npm run lint`, `npm run typecheck` | +| Unit and contract tests | `npm test` | +| Production build and end-to-end verification | `npm run build`, `npm run verify:e2e` | + ## What was not verified - **The real API.** The app has never run against `django-ninja-mongo-api` with a live MongoDB. The mock in `mock-api/server.mjs` was written by reading that API's routers and schemas, so it can drift from the real service. - **A browser.** None was available. Hydration, the pending state of `useActionState` forms, how React resets a form after a client-side submit, visual rendering, dark mode, the responsive layout and keyboard focus order were not exercised. The HTTP-level checks cover the no-JavaScript path. - **The session check inside each Server Function, in isolation.** `proxy.ts` matches the same paths, so a request without a cookie is redirected before a Server Function runs. The forged-cookie scenario does exercise the API-rejection path; the in-function check itself is covered by reading the code, not by a request. -- **The GitHub Actions workflow.** `.github/workflows/ci.yml` runs the same commands as above on Node 22. The commands were run locally, including from a clean copy without a lockfile; the workflow itself is only as verified as its run history on the Actions tab. - **`npm run dev` beyond a smoke test.** It was started and `/login` and the proxy redirect were checked; the full flow was verified on the production build. +What has been observed on GitHub: the first CI run on `main` passed in all three jobs, and the job logs show the same results as the local runs above (59 tests, 40/40 end-to-end checks). The run history on the Actions tab is the source of truth for anything after that. + ## Dependency pinning Direct dependencies are pinned to exact versions in `package.json` (`.npmrc` sets `save-exact`). There is **no `package-lock.json`** in the repository, so transitive dependencies resolve at install time.