Skip to content
Open
Show file tree
Hide file tree
Changes from 6 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
102 changes: 102 additions & 0 deletions .github/workflows/frontend-ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,102 @@
name: Frontend CI

on:
pull_request:
branches: ["main"]
paths:
- 'frontend/**'
- '.github/workflows/frontend-ci.yml'
push:
branches: ["main"]
paths:
- 'frontend/**'
- '.github/workflows/frontend-ci.yml'
workflow_dispatch:

permissions:
contents: read

jobs:
frontend-quality:
name: Frontend Quality Checks
runs-on: ubuntu-latest
defaults:
run:
working-directory: frontend

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: frontend/package-lock.json

- name: Install dependencies
run: |
if [ -f package-lock.json ]; then
echo "✓ Using npm ci for reproducible installs"
npm ci
else
echo "⚠ No package-lock.json found, using npm install"
npm install
fi

- name: Run ESLint
run: npm run lint

- name: Run TypeScript type checking
run: npx tsc --noEmit

Copilot AI Feb 8, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow runs TypeScript checking twice: npx tsc --noEmit here, and npm run build (per frontend/package.json) also invokes tsc before vite build. Consider either (a) changing the workflow build step to run vite build directly, or (b) dropping the standalone tsc --noEmit step and relying on the build script, to avoid duplicated work and reduce CI time.

Suggested change
- name: Run TypeScript type checking
run: npx tsc --noEmit

Copilot uses AI. Check for mistakes.
- name: Build application
run: npm run build

- name: Run tests
run: npm test -- --run

- name: Generate coverage report

Copilot AI Feb 8, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow runs the test suite twice (npm test -- --run and then npm run test:coverage -- --run). This roughly doubles CI time and can undermine the “under 5 minutes” goal. Consider running only the coverage command (which already executes tests) and using its exit code as the test gate, or generate coverage in the primary test run.

Suggested change
- name: Run tests
run: npm test -- --run
- name: Generate coverage report
- name: Run tests with coverage

Copilot uses AI. Check for mistakes.
run: npm run test:coverage -- --run

- name: Upload coverage to Codecov
uses: codecov/codecov-action@v4
with:
files: ./frontend/coverage/lcov.info
flags: frontend
name: frontend-coverage
fail_ci_if_error: false
continue-on-error: true

- name: Upload coverage to Codacy
if: ${{ secrets.CODACY_PROJECT_TOKEN != '' }}
uses: codacy/codacy-coverage-reporter-action@v1
with:
project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
coverage-reports: frontend/coverage/lcov.info
continue-on-error: true
Comment on lines +57 to +72

Copilot AI Feb 8, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In other workflows (e.g. ci.yml), third-party actions like Codecov and Codacy coverage reporter are pinned to a specific commit SHA. Here they’re referenced by floating tags (codecov/codecov-action@v4, codacy/codacy-coverage-reporter-action@v1), which increases supply-chain risk. Consider pinning these to known-good SHAs (optionally with a comment noting the upstream version).

Copilot uses AI. Check for mistakes.

summary:
name: Quality Summary
runs-on: ubuntu-latest
needs: frontend-quality
if: always()
steps:
- name: Generate summary
run: |
echo "## Frontend CI Results 🚀" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
if [ "${{ needs.frontend-quality.result }}" == "success" ]; then
echo "✅ ESLint passed" >> $GITHUB_STEP_SUMMARY
echo "✅ TypeScript type checking passed" >> $GITHUB_STEP_SUMMARY
echo "✅ Build successful" >> $GITHUB_STEP_SUMMARY
echo "✅ Tests passed" >> $GITHUB_STEP_SUMMARY
echo "✅ Coverage generated" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "All frontend quality checks completed! 🎉" >> $GITHUB_STEP_SUMMARY
else
echo "❌ Some quality checks failed" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "Please review the logs above for details." >> $GITHUB_STEP_SUMMARY
fi
48 changes: 39 additions & 9 deletions CONTRIBUTING.md
Original file line number Diff line number Diff line change
Expand Up @@ -432,10 +432,23 @@ npm test
# Run with coverage
npm run test:coverage

# Run in watch mode
npm run test:watch
# Run in watch mode (development)
npm test

# Type checking
npx tsc --noEmit

# Linting
npm run lint

# Build verification
npm run build
```

**Coverage Requirements**:
- Aim for good test coverage on new components
- Coverage reports are uploaded to Codecov automatically in CI

## 🔄 CI/CD and GitHub Actions

### Understanding Our CI/CD Workflows
Expand All @@ -444,14 +457,23 @@ The project uses several GitHub Actions workflows for automated testing and code

**1. CI Pipeline** (`.github/workflows/ci.yml`)
- **Runs on**: All PRs and pushes to main
- **Purpose**: Fast feedback on code quality and test results
- **Purpose**: Fast feedback on backend code quality and test results
- **What it does**:
- Runs backend tests with pytest (enforces 80%+ coverage)
- Runs frontend tests and linting
- Uploads coverage to Codacy and GitHub (when secrets available)
- **Note**: Coverage upload is optional - works without secrets for external contributors
- Uploads coverage to Codacy and Codecov

**2. Security Scans** (`.github/workflows/security-scheduled.yml`)
**2. Frontend CI** (`.github/workflows/frontend-ci.yml`) ✨ **NEW**
- **Runs on**: All PRs and pushes to main (only when frontend files change)
- **Purpose**: Frontend quality validation
- **What it does**:
- ESLint code quality checks
- TypeScript type checking (tsc --noEmit)
- Vite build verification
- Vitest unit tests with coverage
- Uploads coverage to Codecov and Codacy
- **Performance**: Completes in under 5 minutes with npm caching

**3. Security Scans** (`.github/workflows/security-scheduled.yml`)
- **Runs on**: Weekly schedule (Saturday) and pushes to main
- **Purpose**: Deep security analysis
- **What it does**:
Expand Down Expand Up @@ -578,13 +600,21 @@ npm ci # or npm install if no package-lock.json
# Run linter
npm run lint

# Type checking
npx tsc --noEmit

# Run tests
npm test
npm test -- --run

# Run tests with coverage
npm run test:coverage -- --run

# Build check
npm run build
```

**Note**: All frontend checks run automatically in the Frontend CI workflow. The workflow uses npm caching for faster builds and only runs when frontend files change.

#### Security Scanning (Optional)
```bash
# Install Codacy CLI (optional - for local security scans)
Expand All @@ -600,7 +630,7 @@ java -jar codacy-cli.jar analyze --directory . --format json --output results.js

⚠️ **Test Database Configuration**: CI and production both use PostgreSQL (via `DATABASE_URL` in `.github/workflows/ci.yml`). If you run tests locally with SQLite or another database, be aware of potential behavior differences and ensure migrations and tests are validated against PostgreSQL before merging. See [action items](../_bmad-output/implementation-artifacts/action-items-2026-02-02.md) for details.

⚠️ **Frontend Tests**: Frontend test suite is still being developed. CI runs tests but they are currently optional (continue-on-error).
**Frontend Tests**: Frontend CI is now fully implemented with comprehensive quality checks.

## 📝 Pull Request Process

Expand Down
Loading
Loading