Skip to main content
Was this helpful?

CI and Testing Overview

PrimeCal uses one primary GitHub Actions workflow for validation and separate deploy workflows for Azure releases. The repo is a monorepo with four distinct dependency scopes, so CI is organized by product area instead of one giant npm test.

Repository structure that CI follows​

  • backend-nestjs: NestJS API, MCP runtime, database access, security and integration suites
  • frontend: React/Vite web app, unit tests, integration tests, lint, and production build
  • docs-portal: Docusaurus portal build
  • repo root: orchestration scripts, i18n parity tests, docs QA scripts, Playwright/API smoke/load tooling

Primary validation workflow​

Primary workflow file: .github/workflows/ci-tests-security.yml

Core lanes:

  • quality: backend build plus frontend lint and typechecked build
  • i18n: translation parity and translation-quality checks from the repo root
  • backend-core: backend unit tests, backend security tests, and raw SQL audit
  • backend-integration: NestJS integration tests with testcontainers
  • backend-e2e: backend e2e suite
  • mcp-integration: MCP protocol and agent integration coverage
  • mcp-security: MCP auth, rate limit, and secure error-path coverage
  • frontend-unit
  • frontend-integration
  • docs-quality: docs:check plus Docusaurus build
  • dependency-audit: npm audit --audit-level=high for root, backend, frontend, and docs

Optional heavier lanes:

  • web-e2e
  • mobile-e2e
  • api-smoke via scripts/test/test-api.js
  • load-smoke
  • zap-baseline
  • load-deep
  • zap-deep

What runs when​

Pull requests to main​

Runs the core validation lanes above. Dependabot pull requests use the same workflow and are expected to satisfy the same gates as feature work.

Pushes to main, codex/*, and release/*​

Runs the same core validation lanes. On main, heavier smoke/security lanes can also run automatically where configured.

Docs-only changes​

The workflow detects docs-only changes and skips the full app matrix. Docs-only updates still run the docs quality lane so broken links, missing metadata, and Docusaurus build regressions fail fast.

Manual workflow dispatch​

Use manual dispatch to opt into heavier Playwright, API smoke, load, or deeper ZAP lanes when a change needs that coverage without making every PR pay the cost.

Deploy workflow policy​

PrimeCal uses a hybrid release model:

  • Backend: auto-deploy from main
  • Docs portal: auto-deploy from main after docs QA passes
  • Frontend app: manual release workflow
  • Root site: manual release workflow

Legacy Azure Static Web Apps workflows were retired to remove duplicate deploy paths and token-based drift.

Current hosted verification blocker​

As of July 10, 2026, GitHub-hosted Actions runs are externally blocked by repository billing and spending-limit issues. Local and manual verification is the working acceptance path until the repository owner restores billing.

Required owner follow-up after billing is restored:

  1. Re-run CI - Tests and Security on the working branch and on the PR.
  2. Re-run any changed deploy workflow.
  3. Confirm Dependabot PRs receive the same required checks.
  4. Capture stable workflow screenshots for the portal if documentation needs them.

Local equivalents​

Run these before opening or merging a PR:

npm run ci:quality
npm run ci:i18n
npm --prefix backend-nestjs run test:unit
npm --prefix backend-nestjs run test:security
npm --prefix backend-nestjs run test:integration
npm --prefix backend-nestjs run test:e2e
npm --prefix backend-nestjs run test:mcp:integration
npm --prefix backend-nestjs run test:mcp:security
npm --prefix frontend run lint
npm --prefix frontend run test:unit
npm --prefix frontend run test:integration
npm --prefix frontend run build:typecheck
npm run docs:check
npm run docs:portal:build

Run dependency audits whenever manifests or lockfiles change:

npm run ci:dependency-audit

Screenshots​

Do not block CI documentation on GitHub Actions screenshots while hosted runs are blocked. Capture and publish workflow screenshots only after billing is restored and the workflow graph reflects the live, passing configuration.