Feature/refactor

.env.example

@@ -0,0 +1,31 @@
+# Local environment template. Copy it and fill it in:
+#
+#     cp .env.example .env
+#
+# `.env` is gitignored; this template is committed so a fresh clone can see what it
+# needs instead of finding out from a blank page. Vite only exposes variables
+# prefixed with VITE_ to the browser bundle.
+#
+# Every variable the app reads is declared and typed in src/env.ts.
+
+# --- Required ---------------------------------------------------------------
+
+# Firebase web API key.
+# Firebase console -> Project settings -> Your apps -> Web app -> API key.
+# Without it the app cannot initialise Firebase, so sign-in (and therefore the
+# API docs) will not work. src/env.ts checks this before rendering and prints an
+# actionable error rather than failing mysteriously later.
+VITE_FirebaseAPIKey=
+
+# --- Optional ---------------------------------------------------------------
+
+# Release tag shown in the site footer. CI writes this during deploy; leave it
+# unset locally and the footer shows "dev".
+VITE_TAG=
+
+# --- NOT read from this file --------------------------------------------------
+
+# ACCESS_TOKEN, used by `npm run spec` (scripts/downloadYML.js), is read from the
+# real process environment. Nothing loads `.env` into Node, so put it in your
+# shell or a CI `env:` entry rather than here. It is optional: the OpenAPI release
+# asset downloads anonymously, and the token only helps with rate limits.

.github/workflows/deploy.yml

@@ -5,30 +5,62 @@ on:
       - master
 
 jobs:
+  # Publishing is gated on the test suite. Previously `build` ran straight into the
+  # artifact upload, so a deploy - including a manually re-run one - could ship
+  # code that fails its own tests. The check set lives in package.json (`npm run
+  # verify`) rather than being restated here, so this workflow and test.yml cannot
+  # drift apart.
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: nodejs
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - name: install dependencies
+        run: npm ci
+      - name: generate OpenAPI spec
+        # src/swagger_spec.json is git-ignored and imported by app code, so the
+        # browser tests cannot even load the module graph without it.
+        run: npm run spec
+        env:
+          ACCESS_TOKEN: ${{ secrets.ACCESS_TOKEN }}
+      - name: install browser test dependencies
+        run: npx playwright install --with-deps chromium
+      - name: verify
+        run: npm run verify
+
   build:
     runs-on: ubuntu-latest
+    needs: test
     steps:
       - uses: actions/checkout@v4
       - name: nodejs
         uses: actions/setup-node@v4
         with:
-          node-version: "23.5.0"
-      - name: setup for deploy
+          node-version-file: .nvmrc
+          cache: npm
+      - name: install dependencies
+        run: npm ci
+      - name: generate OpenAPI spec
+        # Also writes scripts/releases.json, which scripts/outputTag reads below.
+        run: npm run spec
+        env:
+          ACCESS_TOKEN: ${{ secrets.ACCESS_TOKEN }}
+      - name: build
         run: |
-          for i in {1..5}; do curl -L -H "Authorization: token  ${{ secrets.ACCESS_TOKEN }}" -o ./scripts/releases.json https://api.github.com/repos/realoptions/option_price_faas/releases/latest && break || sleep 10; done
           tag=$(node ./scripts/outputTag)
           echo "VITE_TAG=$tag" >> .env
-          echo "this is the tag #: $tag"
           echo "VITE_FirebaseAPIKey=${{ secrets.FIREBASE_API_KEY }}" >> .env
-          npm ci
-          access_token=${{ secrets.ACCESS_TOKEN }} node ./scripts/downloadYML.js
           npm run build
         env:
           CI: true
 
       - name: Upload static files as artifact
         id: deployment
-        uses: actions/upload-pages-artifact@v3 # or specific "vX.X.X" version tag for this action
+        uses: actions/upload-pages-artifact@v3
         with:
           path: dist/
 

.github/workflows/test.yml

@@ -9,16 +9,25 @@ jobs:
       - name: nodejs
         uses: actions/setup-node@v4
         with:
-          node-version: "23.5.0"
-      - name: test install
-        run: |
-          npm ci
-          for i in {1..5}; do curl -L -H "Authorization: token  ${{ secrets.ACCESS_TOKEN }}" -o ./scripts/releases.json https://api.github.com/repos/realoptions/option_price_faas/releases/latest && break || sleep 10; done
-          tag=$(node ./scripts/outputTag)
-          echo "VITE_TAG=$tag" >> .env
-          echo "this is the tag #: $tag"
-          echo "VITE_FirebaseAPIKey=${{ secrets.FIREBASE_API_KEY }}" >> .env
-          access_token=${{ secrets.ACCESS_TOKEN }} node ./scripts/downloadYML.js
-          npm run build
+          node-version-file: .nvmrc
+          cache: npm
+      - name: install dependencies
+        run: npm ci
+      - name: generate OpenAPI spec
+        # src/swagger_spec.json is git-ignored and imported by src/App.tsx, so it must
+        # be generated before typecheck/build. The token guards against the anonymous
+        # GitHub API rate limit that shared CI runner IPs are prone to hit.
+        run: npm run spec
+        env:
+          ACCESS_TOKEN: ${{ secrets.ACCESS_TOKEN }}
+      - name: install browser test dependencies
+        run: npx playwright install --with-deps chromium
+      # The check set itself is defined once, in package.json, and shared with the
+      # deploy workflow's gating job. Restating the steps in each workflow is how
+      # the two would quietly drift apart.
+      - name: verify
+        run: npm run verify
+      - name: build
+        run: npm run build
         env:
           CI: true

.gitignore

@@ -26,3 +26,7 @@ openapi_v2.yml
 releases.json
 swagger_spec.json
 dist
+
+# vitest browser-mode artifacts (failure screenshots, captured attachments)
+__screenshots__/
+.vitest-attachments/

.nvmrc

@@ -0,0 +1 @@
+24