refactor(ci): volledig opnieuw geschreven CI workflow

- Check job: lint, typecheck, test in node:26 container
- Deploy job: Docker build + deploy + health check op host
- Corepack pnpm installatie
- BuildKit caching
- Contract tests herschreven (18 tests)

src/lib/ci-workflow-contract.test.ts

@@ -2,32 +2,50 @@ import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { describe, expect, it } from "vitest";
 
-describe("CI workflow", () => {
-	const workflow = readFileSync(
-		resolve(process.cwd(), ".gitea/workflows/ci.yaml"),
-		"utf8",
-	).replace(/\r\n/g, "\n");
+const workflow = readFileSync(
+	resolve(process.cwd(), ".gitea/workflows/ci.yaml"),
+	"utf8",
+);
 
-	it("runs check then production deploy on push to main", () => {
+describe("CI workflow", () => {
+	it("has check and deploy jobs", () => {
+		expect(workflow).toContain("check:");
+		expect(workflow).toContain("deploy:");
+	});
+
+	it("deploy depends on check", () => {
+		expect(workflow).toContain("needs: check");
+	});
+
+	it("deploy only runs on push to main/master", () => {
+		expect(workflow).toContain("gitea.event_name == 'push'");
+		expect(workflow).toContain("gitea.ref_name == 'main'");
+	});
+
+	it("check runs lint, typecheck, and test", () => {
 		expect(workflow).toContain("pnpm biome:lint");
 		expect(workflow).toContain("pnpm typecheck");
 		expect(workflow).toContain("pnpm test");
-		expect(workflow).toContain("needs: check");
-		expect(workflow).toContain("gitea.event_name == 'push'");
-		expect(workflow).toContain("gitea.ref_name == 'main'");
-		expect(workflow).toContain("/api/health");
+	});
+
+	it("deploy uses self-hosted runner", () => {
+		expect(workflow).toContain("runs-on: self-hosted");
+	});
+
+	it("check uses ubuntu-latest runner", () => {
+		expect(workflow).toContain("runs-on: ubuntu-latest");
+	});
+
+	it("installs pnpm via corepack", () => {
+		expect(workflow).toContain("corepack enable");
+		expect(workflow).toContain("corepack prepare [email protected]");
+	});
+
+	it("does not use github context", () => {
 		expect(workflow).not.toContain("github.ref");
 	});
 
-	it("uses Gitea SHA for check checkout", () => {
-		expect(workflow).toContain("SKIP_ENV_VALIDATION");
-	});
-
-	it("includes tag triggers", () => {
-		expect(workflow).toContain('tags:\n      - "v*"');
-	});
-
-	it("sets test environment variables as global env", () => {
-		expect(workflow).toContain("SKIP_ENV_VALIDATION: 1");
+	it("has tag trigger", () => {
+		expect(workflow).toContain('tags: ["v*"]');
 	});
 });

src/lib/deploy-workflow-contract.test.ts

@@ -2,63 +2,53 @@ import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { describe, expect, it } from "vitest";
 
-describe("production deploy workflow", () => {
-	const workflow = readFileSync(
-		resolve(process.cwd(), ".gitea/workflows/ci.yaml"),
-		"utf8",
-	);
-	const deployStart = workflow.indexOf("\n  deploy:");
-	const deployJob = deployStart > -1 ? workflow.slice(deployStart) : "";
+const workflow = readFileSync(
+	resolve(process.cwd(), ".gitea/workflows/ci.yaml"),
+	"utf8",
+);
+const deployStart = workflow.indexOf("\n  deploy:");
+const deployJob = deployStart > -1 ? workflow.slice(deployStart) : "";
 
-	it("is gated behind the check job", () => {
-		expect(deployJob).toContain("needs: check");
-		expect(deployJob).toContain("gitea.event_name == 'push'");
-		expect(deployJob).toContain("gitea.ref_name == 'main'");
-	});
-
-	it("runs on self-hosted runner for Docker access", () => {
+describe("deploy job", () => {
+	it("runs on self-hosted for Docker access", () => {
 		expect(deployJob).toContain("runs-on: self-hosted");
 	});
 
-	it("builds Docker image with production settings", () => {
+	it("builds Docker image with BuildKit", () => {
+		expect(deployJob).toContain("DOCKER_BUILDKIT=1");
 		expect(deployJob).toContain("docker build");
 		expect(deployJob).toContain("-t epicnext-cms:latest");
-		expect(deployJob).toContain("--build-arg NODE_OPTIONS");
 	});
 
-	it("stops and removes previous container before starting new one", () => {
+	it("stops old container before starting new one", () => {
 		expect(deployJob).toContain("docker stop epicnext-cms-app");
 		expect(deployJob).toContain("docker rm epicnext-cms-app");
 	});
 
-	it("starts container with host networking and restart policy", () => {
+	it("starts container with correct settings", () => {
 		expect(deployJob).toContain("--restart always");
 		expect(deployJob).toContain("--net=host");
 		expect(deployJob).toContain("--name epicnext-cms-app");
 	});
 
-	it("runs HTTP health check after deployment", () => {
+	it("runs health check", () => {
 		expect(deployJob).toContain("/api/health");
 		expect(deployJob).toContain('"database":true');
 	});
 
-	it("cleans up old Docker images after deploy", () => {
+	it("cleans up old images", () => {
 		expect(deployJob).toContain("docker image prune -f");
 	});
 
-	it("does not override onlyBuiltDependencies (uses pnpm-workspace.yaml)", () => {
-		expect(workflow).not.toContain("PNPM_CONFIG_ONLY_BUILT_DEPENDENCIES");
-	});
-
-	it("does not use pnpm test in deploy", () => {
+	it("does not run pnpm test in deploy", () => {
 		expect(deployJob).not.toContain("pnpm test");
 	});
 
-	it("reports deploy logs on health check failure", () => {
+	it("shows docker logs on failure", () => {
 		expect(deployJob).toContain("docker logs epicnext-cms-app");
 	});
 
-	it("produces meaningful error on health failure", () => {
-		expect(deployJob).toContain("ERROR: Health check failed!");
+	it("exits with error on health check failure", () => {
+		expect(deployJob).toContain("exit 1");
 	});
 });