Changeset 0.9.0 (#50)

.gitea/workflows/ci.yaml

@@ -1,13 +1,14 @@
 # .gitea/workflows/ci.yaml
 # ============================================
-# Chat Switchboard - CI/CD Pipeline (v0.6.2)
+# Chat Switchboard - CI/CD Pipeline (v0.9.0)
 # ============================================
 # Cluster deployments use SEPARATE FE + BE images.
 # Unified image is for Docker Hub only (docker-compose use).
 #
 # Pipeline:
-#   1. Go test (all PRs and pushes)
-#   2. Build + Deploy (depends on test passing)
+#   1a. Frontend tests (Node.js — contracts, model logic, policy wiring)
+#   1b. Go test (all PRs and pushes)
+#   2.  Build + Deploy (depends on both test jobs passing)
 #
 # Deployment mapping (single domain, path-based):
 #   PR              → FE + BE :dev    → switchboard.DOMAIN/dev/  (DB wipe + fresh schema)
@@ -34,6 +35,7 @@
 #   POSTGRES_USER, POSTGRES_PASSWORD
 #   POSTGRES_ADMIN_USER, POSTGRES_ADMIN_PASSWORD
 #   SWITCHBOARD_ADMIN_USERNAME, SWITCHBOARD_ADMIN_PASSWORD, SWITCHBOARD_ADMIN_EMAIL
+#   VENICE_API_KEY (live provider integration tests — optional, tests skip if missing)
 #   DOCKERHUB_USERNAME, DOCKERHUB_TOKEN (optional)
 #
 # Global Variables (Gitea org-level):
@@ -65,12 +67,34 @@ env:
   DOCKERHUB_IMAGE: ${{ vars.DOCKERHUB_IMAGE || 'gobha/chat-switchboard' }}
 
 jobs:
-  # ── Stage 1: Go Build & Test ─────────────────
+  # ── Stage 1a: Frontend Tests ─────────────────
+  # API contract tests, model processing, policy wiring audits.
+  # Uses Node.js built-in test runner (node --test), zero npm deps.
+  test-frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Verify Node.js
+        run: |
+          echo "Node $(node --version)"
+          NODE_MAJOR=$(node -v | sed 's/v//' | cut -d. -f1)
+          if [ "$NODE_MAJOR" -lt 21 ]; then
+            echo "❌ Node >= 21 required for built-in test runner (have v${NODE_MAJOR})"
+            exit 1
+          fi
+
+      - name: Run frontend tests
+        run: node --test src/js/__tests__/*.test.js
+
+  # ── Stage 1b: Go Build & Test ────────────────
   test:
     runs-on: ubuntu-latest
     env:
       GOPRIVATE: git.gobha.me/*
       GONOSUMCHECK: git.gobha.me/*
+      VENICE_API_KEY: ${{ secrets.VENICE_API_KEY }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -142,7 +166,7 @@ jobs:
   # ── Stage 2: Build, Database, Deploy ─────────
   build-and-deploy:
     runs-on: ubuntu-latest
-    needs: test
+    needs: [test, test-frontend]
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -223,9 +247,6 @@ jobs:
           fi
 
       # ── Database Bootstrap (admin creds) ───────
-      # Creates the database and app role if they don't exist.
-      # Idempotent — safe to run every build. Uses admin creds
-      # that the backend pods never see.
       - name: Bootstrap database
         env:
           PGHOST: ${{ env.POSTGRES_HOST }}
@@ -240,9 +261,6 @@ jobs:
           scripts/db-bootstrap.sh
 
       # ── Dev: Upgrade Test (dev only) ───────────
-      # The dev DB still has the PREVIOUS PR's schema.
-      # Apply THIS PR's migrations to test the upgrade path.
-      # If migration fails → CI fails before build.
       - name: "Dev: test migration upgrade"
         if: steps.env.outputs.DB_WIPE == 'true'
         env:
@@ -254,7 +272,6 @@ jobs:
         run: |
           echo "━━━ Upgrade test: applying migrations to existing dev DB ━━━"
 
-          # Ensure tracking table exists (first run or after manual wipe)
           psql -v ON_ERROR_STOP=1 <<'SQL'
           CREATE TABLE IF NOT EXISTS schema_migrations (
               version    VARCHAR(255) PRIMARY KEY,
@@ -296,8 +313,6 @@ jobs:
           fi
 
       # ── Dev: Validate Schema ───────────────────
-      # After upgrade, verify all expected tables/columns exist.
-      # Catches migrations that apply cleanly but produce wrong schema.
       - name: "Dev: validate schema"
         if: steps.env.outputs.DB_WIPE == 'true'
         env:
@@ -311,9 +326,6 @@ jobs:
           scripts/db-validate.sh
 
       # ── Dev Wipe (fresh install test) ──────────
-      # Upgrade test passed. Now wipe so the deploy tests a
-      # full fresh-install migration via the backend binary.
-      # SAFETY: hard-refuses on any database not ending in _dev.
       - name: "Dev: wipe for fresh install test"
         if: steps.env.outputs.DB_WIPE == 'true'
         env:
@@ -325,7 +337,6 @@ jobs:
         run: |
           DB="${{ steps.env.outputs.DB_NAME }}"
 
-          # ── SAFETY: only wipe databases ending in _dev ──
           if [[ "${DB}" != *_dev ]]; then
             echo "❌ REFUSING to wipe '${DB}' — only *_dev databases can be wiped"
             exit 1
@@ -343,11 +354,6 @@ jobs:
           SQL
           echo "✓ Dev wipe complete — backend will rebuild schema on startup"
 
-      # Dev exercises BOTH paths:
-      #   1. Upgrade test above:     existing schema → new migrations (psql)
-      #   2. Fresh install on deploy: empty DB → all migrations (backend binary)
-      # Test/Prod: backend applies only pending migrations on startup.
-
       # ── Build Backend Image ──────────────────────
       - name: Build backend image
         run: |
@@ -485,7 +491,6 @@ jobs:
           HEALTH=$(curl -sf "https://${HOST}${BP}/api/v1/health" 2>/dev/null || echo "unreachable")
           echo "Health: ${HEALTH}"
 
-          # Extract fields (|| true prevents set -e from killing on no-match)
           SCHEMA=$(echo "${HEALTH}" | grep -o '"schema_version":"[^"]*"' | cut -d'"' -f4 || true)
           DB_OK=$(echo "${HEALTH}" | grep -o '"database":true' || true)