- M1: E2E_REQUIRE_SEEDED_AUTH=1 in the CI e2e step makes login failures hard
failures (loginAs throws, guards disabled, globalSetup refuses a pre-populated
DB); auth.spec redirect test asserts outright under the flag; non-admin
/admin test is now a real authorization assertion
- M2: ci.yml build step depends_on test — never two concurrent turbo builds
on the shared workspace
- M3: unknown /assets/* paths 404 from the SPA catch-all instead of serving
index.html with an immutable cache header; spec arm added
- minors: e2e step gets when: *image_build_when, health poll uses
GATEWAY_PORT + AbortSignal.timeout, BETTER_AUTH_SECRET generated per run
(no literal in tree), failure echoes artifact path, dev-guide documents the
gate, stale verify-release comment fixed
- ci.yml: build step (vite build via turbo) runs on every PR pipeline after test
- publish.yml: e2e step boots the gateway from built dist (HOME/cwd-isolated
throwaway PGlite) and runs the Playwright suite headless inside
mcr.microsoft.com/playwright:v1.58.2-noble against the SPA bundle served
exactly as production serves it; both kaniko publishes now gate on e2e
- serve-spa.ts: strip query strings before asset resolution; immutable
cache-control for hashed assets (onSend hook); e2e spec covers both
- e2e suite hardened: globalSetup seeds admin+member through real
bootstrap/better-auth APIs (Origin header for CSRF), loginAs waits for the
post-login redirect (fixes 27-skipped race), stale #152-era assertions
rewritten to the current command-driven UI, strict-mode violations fixed
with level-1 heading queries and .or() auto-retrying locators
- verify-release mirrors the new build stage; playwright artifacts ignored
Per ops-ci-01's procedure (comments 23386/23394, brain D27): pipeline config
travels with the commit under test, so the controlled rerun requires the pinned
anchor in the PR head itself. This merge absorbs everything next took since the
original merge parent (1bdeed62): the ci-base pin (cb9a0d1, lock-9cb7ffcd8828),
the legacy-credential removal (#1325), and the ci-queue-wait statuses:null fix
(#1129 — the branch from the divergence analysis, now landed).
One conflict, same file as round 1: test:framework-shell union — our 54-entry
chain plus next's new test-ci-queue-wait-no-status.sh entry at its position
(55 entries, every target existence-verified). Enumeration guard green:
population 61, enumerated 46, excluded (signed) 16.
Squash-merged by topher (jarvis principal) via break-glass: pr-merge.sh hard-codes main-only merge targets and cannot express this repo's next trunk. Gates: CI 2476 green at head 46784c8d, review 177 APPROVED (fred) at pinned head. First gated publish: every publish step now depends on verify-release at the exact commit.
invariant_r_unittest.py (landing with the lease-remediation stack, PR
#1109) hard-requires an installed `pi` binary pinned to the measured
version: it boots Pi's real tool registry and proves the broker's
read-only carve-out resolves to real, unshadowed builtins. Absent
runtime fails loud by design — so CI must provide it.
Install @earendil-works/[email protected].1 (the canonical Pi;
@mariozechner/* is embedded-legacy) at step level in the test step.
Step-level rather than baked into Dockerfile.ci because ci-image
publishes are currently blocked on registry UNAUTHORIZED; baking it in
is the follow-up once registry auth is fixed, at which point this line
degrades to a fast no-op guard like the openssl line above it.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Dtdjx4Gxude9fwyLezCrhh
Each step was re-running pnpm install independently, and all quality
steps (typecheck, lint, format, test) ran in parallel. On merge commits
with more accumulated code this pushed the CI runner over its memory
limit (exit code 254 = OOM kill).
Fix:
- install once, share node_modules via Woodpecker workspace volume
- sequential execution: install → typecheck → lint → format → test → build
- corepack enable in each step (fresh container) but no redundant install
fred
orch-01
code-be-01andorch-01
fredandgate-merge-01
ops-ci-01
ops-01
jarvis
jason.woltjeandMos