- M1: E2E_REQUIRE_SEEDED_AUTH=1 in the CI e2e step makes login failures hard
failures (loginAs throws, guards disabled, globalSetup refuses a pre-populated
DB); auth.spec redirect test asserts outright under the flag; non-admin
/admin test is now a real authorization assertion
- M2: ci.yml build step depends_on test — never two concurrent turbo builds
on the shared workspace
- M3: unknown /assets/* paths 404 from the SPA catch-all instead of serving
index.html with an immutable cache header; spec arm added
- minors: e2e step gets when: *image_build_when, health poll uses
GATEWAY_PORT + AbortSignal.timeout, BETTER_AUTH_SECRET generated per run
(no literal in tree), failure echoes artifact path, dev-guide documents the
gate, stale verify-release comment fixed
- ci.yml: build step (vite build via turbo) runs on every PR pipeline after test
- publish.yml: e2e step boots the gateway from built dist (HOME/cwd-isolated
throwaway PGlite) and runs the Playwright suite headless inside
mcr.microsoft.com/playwright:v1.58.2-noble against the SPA bundle served
exactly as production serves it; both kaniko publishes now gate on e2e
- serve-spa.ts: strip query strings before asset resolution; immutable
cache-control for hashed assets (onSend hook); e2e spec covers both
- e2e suite hardened: globalSetup seeds admin+member through real
bootstrap/better-auth APIs (Origin header for CSRF), loginAs waits for the
post-login redirect (fixes 27-skipped race), stale #152-era assertions
rewritten to the current command-driven UI, strict-mode violations fixed
with level-1 heading queries and .or() auto-retrying locators
- verify-release mirrors the new build stage; playwright artifacts ignored