Testing & CI

Framework

Tests run on Vitest 4 (vitest: ^4.1.10 in package.json), via npm test which runs vitest run (package.json:10). Playwright is also a dev dependency (package.json:31) but there is no Playwright config or spec file in the repo today — it’s installed, not yet wired into a suite or the CI pipeline.

What’s actually covered

Coverage is narrow and deliberately targeted at the highest-risk logic — not a general unit-test sweep of the codebase. The complete list of test files under src/ today:

• src/lib/rate-limit.test.ts — the in-memory throttle/eviction behavior.
• src/lib/blocks/sandbox.test.ts — buildSandboxSrcDoc’s closing-tag escaping and nonce stamping.
• src/lib/blocks/safe-url.test.ts — URL sanitization used by block configs that accept a host-supplied URL.
• src/lib/cache/keyed-cache.test.ts— the keyed cache’s TTL and invalidation behavior.
• src/lib/schemas/page-schema.test.ts — parsePageSchema’s structural validation and per-block drop-on-invalid behavior.

Notably untested: the data layer (src/lib/data/), server actions, RSVP/form submission validation, and every UI component. Treat this suite as a guard against regressing a handful of specific, previously-fixed correctness bugs, not as a safety net for the app as a whole.

CI pipeline

.github/workflows/ci.yml runs on every push to main and every pull request, in this order:

1. Checkout (actions/checkout@v4).
2. Set up Node 24 with npm caching (actions/setup-node@v4).
3. npm ci.
4. npm run lint.
5. npm test.
6. npm run build, with placeholder env vars (Supabase URL/keys, Resend key, site URL, guest session secret) set only so modules that read them eagerly don’t fail the build — nothing in the build step actually calls Supabase, since every data-fetching route is force-dynamic.