chore(ci): enhance CI workflows with unit tests, improved fetch depth, and new script for PR diff reporting

Author: alienx5499

.github/workflows/README.md

@@ -11,20 +11,14 @@ Workflows are split by responsibility. **Node.js 24** is used in CI to match [`S
 | Job | Purpose |
 |-----|---------|
 | **Format and lint** | Prettier (`pnpm run format:check`) then ESLint (one setup; runs **in parallel** with **Build**). |
-| **Build** | Single `pnpm run build`; uploads `SortVision/.next` as artifact `next-build` (no duplicate builds downstream). |
+| **Build** | `pnpm run build`, **bundle size** notes (warn if build exceeds 50MB), **generate + validate** `public/sitemap.xml`; uploads `SortVision/.next` as artifact `next-build` (no duplicate builds downstream). |
 | **Test** | After **Build**: `pnpm install` + restore `next-build` tarball, **`next start`**, `pnpm test`, PR QA comment + `qa-pr-comment` artifact. Runs **in parallel** with **Lighthouse**. |
 | **Lighthouse** | After **Build**: install + download `next-build`, **`next start`**, mobile + desktop Lighthouse ([`lighthouserc.json`](../../SortVision/lighthouserc.json), [`lighthouserc.desktop.json`](../../SortVision/lighthouserc.desktop.json)); uploads `lighthouse-manifest-{mobile,desktop}` (manifest after the treosh action) for the summary job. |
 | **Lighthouse summary** | Merges mobile/desktop manifests, **job summary** + **PR comment** (same pattern as QA), gates Lighthouse. |
 | **Production validation** | On `main` / `master` only, after **Test** and **Lighthouse** (+ summary): production smoke tests and HTTP checks |
 
 Shared setup: [`setup-sortvision`](../actions/setup-sortvision/action.yml) (pnpm, Node, `pnpm install`). Consumer jobs use [`restore-next-build`](../actions/restore-next-build/action.yml) after **Build** to unpack `next-build.tar.gz` into `SortVision/.next`.
 
-### `extended-quality-assurance.yml`
-
-**Triggers:** nightly (`0 2 * * *` UTC), `workflow_dispatch`.
-
-Longer validation: format, lint, build, `pnpm run test:extended`, sitemap, **pnpm audit** (fails on high/critical for production deps), bundle notes, artifacts.
-
 ### `security-scan.yml`
 
 **Triggers:** push/PR, **merge queue** (`merge_group`), weekly schedule.
@@ -61,8 +55,6 @@ Merge queue uses a **temporary branch** (ref like `refs/heads/gh-readonly-queue/
 - [`typos.yml`](typos.yml)
 - [`security-scan.yml`](security-scan.yml) — audit + TruffleHog run; **Dependency Review** stays `pull_request`-only by design.
 
-**Not** run on merge queue: [`extended-quality-assurance.yml`](extended-quality-assurance.yml) (scheduled/manual only) — too heavy for every queue entry.
-
 **How “PR tests” vs “merge queue tests” relate:** Each PR still gets normal `pull_request` runs. When you click **Merge when ready**, GitHub runs required checks again on the **merge group** commit (integration of `main` + your change, and possibly other queued PRs depending on queue mode). One green merge-group run can clear the next merge for batched queues; if something fails, the queue is blocked or that PR is dropped per GitHub’s rules.
 
 **Enable in GitHub:** **Settings → Rules** (ruleset on `main`) → enable **Merge queue** → choose **Merge method** → list the **same** required status checks as for pull requests. After the first merge-group run, confirm check names match **Settings → Rules** (search for checks).
@@ -74,7 +66,6 @@ Required status check names must match each job’s `name:` field exactly (for e
 ## Adding more checks
 
 - **Default PR path:** extend [`continuous-integration.yml`](continuous-integration.yml) or add a job with `needs:` as appropriate.
-- **Nightly / manual only:** use [`extended-quality-assurance.yml`](extended-quality-assurance.yml) or a new workflow file.
 - **Security:** prefer [`security-scan.yml`](security-scan.yml); CodeQL is managed in **Settings → Code scanning** (default setup).
 
 **Not configured here (optional later):** Knip/depcheck for unused exports, Playwright E2E — useful once you want the extra maintenance cost.

.github/workflows/continuous-integration.yml

@@ -45,6 +45,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (node24 runtime; fewer forced-runtime warnings)
+        with:
+          fetch-depth: 1
 
       - name: Setup SortVision
         uses: ./.github/actions/setup-sortvision
@@ -57,6 +59,9 @@ jobs:
       - name: ESLint
         run: pnpm run lint
 
+      - name: Unit tests (node:test)
+        run: pnpm run test:unit
+
   # Runs in parallel with format-lint so wall time is max(static, build), not sum (update branch rules if you required separate "Formatting" / "Lint" checks).
   build:
     name: Build
@@ -65,6 +70,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (node24 runtime; fewer forced-runtime warnings)
+        with:
+          fetch-depth: 1
 
       - name: Cache Next.js build
         uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
@@ -83,6 +90,26 @@ jobs:
         env:
           NODE_ENV: production
 
+      - name: Analyze bundle size
+        run: |
+          echo "=== Bundle Size Analysis ==="
+          du -sh .next/static/chunks/* 2>/dev/null | sort -h | tail -10 || echo "No chunks found"
+          TOTAL_SIZE=$(du -sb .next 2>/dev/null | awk '{print $1}')
+          TOTAL_SIZE_MB=$((TOTAL_SIZE / 1024 / 1024))
+          echo "Total build size: ${TOTAL_SIZE_MB}MB"
+          if [ "$TOTAL_SIZE_MB" -gt 50 ]; then
+            echo "WARNING: Build size exceeds 50MB"
+          fi
+
+      - name: Generate and validate sitemap
+        run: |
+          pnpm run generate-sitemap
+          if [ ! -f public/sitemap.xml ]; then
+            echo "ERROR: Sitemap generation failed"
+            exit 1
+          fi
+          echo "Sitemap generated: $(wc -l < public/sitemap.xml) lines"
+
       # Tarball avoids upload-artifact v4 directory flattening (files must land under SortVision/.next for `next start`).
       - name: Pack Next.js build for CI artifact
         working-directory: ${{ github.workspace }}
@@ -107,6 +134,9 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (node24 runtime; fewer forced-runtime warnings)
+        with:
+          # Full history on PRs so git diff base...head works for the "vs main" table (push stays shallow).
+          fetch-depth: ${{ github.event_name == 'pull_request' && '0' || '1' }}
 
       - name: Setup SortVision
         uses: ./.github/actions/setup-sortvision
@@ -120,12 +150,12 @@ jobs:
         run: |
           pnpm run start &
           echo $! > .server-pid
-          npx wait-on http://localhost:3000 --timeout 120000
+          pnpm exec wait-on http://localhost:3000 --timeout 120000
           sleep 2
 
-      - name: Run complete test suite (600+ tests)
+      - name: Run complete test suite (core + extended sitemap, links, security)
         id: qa_tests
-        run: pnpm test
+        run: pnpm run test:ci
         env:
           CI: 'true'
           GITHUB_ACTIONS: 'true'
@@ -152,6 +182,16 @@ jobs:
             echo '${{ github.event.pull_request.number }}' > "$DIR/pr_number.txt"
           fi
 
+      - name: Append main vs PR diff (tests + scripts)
+        if: github.event_name == 'pull_request' && always()
+        working-directory: ${{ github.workspace }}
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          QA_COMMENT_FILE: ${{ github.workspace }}/SortVision/.qa-pr-comment/comment.md
+        run: node SortVision/scripts/ci-append-pr-vs-base.cjs
+
       - name: Find previous QA comment
         id: find_qa_comment
         if: github.event_name == 'pull_request' && always()
@@ -196,6 +236,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (node24 runtime; fewer forced-runtime warnings)
+        with:
+          fetch-depth: 1
 
       - name: Setup SortVision
         uses: ./.github/actions/setup-sortvision
@@ -209,7 +251,7 @@ jobs:
         run: |
           pnpm run start &
           echo $! > .server-pid
-          npx wait-on http://localhost:3000 --timeout 120000
+          pnpm exec wait-on http://localhost:3000 --timeout 120000
           sleep 2
 
       - name: Lighthouse (${{ matrix.variant }})
@@ -244,8 +286,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - name: Checkout repository
+      - name: Checkout repository (summary script only)
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (node24 runtime; fewer forced-runtime warnings)
+        with:
+          fetch-depth: 1
+          sparse-checkout: |
+            SortVision/scripts/lighthouse-ci-summary.cjs
+          sparse-checkout-cone-mode: false
 
       - name: Download Lighthouse manifests (mobile)
         uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
@@ -323,6 +370,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (node24 runtime; fewer forced-runtime warnings)
+        with:
+          fetch-depth: 1
 
       - name: Setup Node.js
         uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0

.github/workflows/extended-quality-assurance.yml

@@ -4,6 +4,8 @@
   "version": "2.0.0",
   "scripts": {
     "test": "node tests/quality-assurance.mjs",
+    "test:ci": "node tests/quality-assurance.mjs --extended",
+    "test:unit": "node --test \"tests/unit/*.test.mjs\"",
     "test:quick": "node tests/quality-assurance.mjs --quick",
     "test:prod": "node tests/quality-assurance.mjs --production",
     "test:extended": "node tests/quality-assurance.mjs --extended",
@@ -88,7 +90,8 @@
     "globals": "^17.4.0",
     "husky": "^9.1.7",
     "lint-staged": "^16.4.0",
-    "prettier": "^3.8.1"
+    "prettier": "^3.8.1",
+    "wait-on": "9.0.4"
   },
   "engines": {
     "node": ">=24.0.0"