CI script; test report: production smoke/load/a11y/audit

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Simon-Pierre Boucher committed 4 days ago (Oct 30, 2026) parent 870f9a1 Browse files

2 changed files +21 −0

modified docs/TEST_REPORT.md +8 −0

				`@@ -24,6 +24,14 @@ Updated 2026-10-30. Every line below was actually executed; results are copied,`
24	\| Backup + restore \| `scripts/backup.sh` → pg_dump + rsync to `M3U96a:~/backups/autoscholar` (dumps listed offsite); `scripts/restore-test.sh` restored into `autoscholar_restore`, counted rows, verified artifact digests, dropped the DB \|	24	\| Backup + restore \| `scripts/backup.sh` → pg_dump + rsync to `M3U96a:~/backups/autoscholar` (dumps listed offsite); `scripts/restore-test.sh` restored into `autoscholar_restore`, counted rows, verified artifact digests, dropped the DB \|
25	\| Fault found and fixed during the first live run \| second upload of a changed artifact within one attempt collided with the write-once store → HTTP 500 → runner reported a failed attempt → scheduler retried from the preflight checkpoint on attempt 2 (recovery path worked as designed). Fix: per-version storage keys; redeployed with `scripts/deploy-control-plane.sh` (≈5 s gap) \|	25	\| Fault found and fixed during the first live run \| second upload of a changed artifact within one attempt collided with the write-once store → HTTP 500 → runner reported a failed attempt → scheduler retried from the preflight checkpoint on attempt 2 (recovery path worked as designed). Fix: per-version storage keys; redeployed with `scripts/deploy-control-plane.sh` (≈5 s gap) \|
26		26
		27	+## Production smoke, load and accessibility (2026-10-30, over the LAN)
		28	+
		29	+- All 15 public routes return 200 (home, research, topics, series, about, methodology, infrastructure, transparency, 3 legal pages, feed.xml, sitemap.xml, robots.txt) and an unknown paper returns 404; `robots.txt` disallows `/admin` and `/api`.
		30	+- All 12 admin pages return 200 with a valid session; signed-out admin pages redirect (307) to login; admin APIs return 401.
		31	+- Load (20 concurrent clients, 15 s, mixed public pages/APIs from M1M32): 14 683 requests, 979 req/s, p50 17 ms, p95 39 ms, p99 47 ms, max 236 ms; the only errors were HTTP 429 from the public rate limiter (600/min per address) — confirmed by a second 5 s burst returning 100 % 429.
		32	+- Accessibility: axe-core wcag2a/aa on 11 public pages in the e2e suite (0 violations); keyboard skip link and reduced-motion verified.
		33	+- Dependency audit: `pnpm audit --prod` → 0 known vulnerabilities after upgrading pdfjs-dist to 6.4 (GHSA-hq66-cqwq-w95j).
		34	+
27	## Live research runs	35	## Live research runs
28		36
29	Recorded below as they complete (run IDs, stages, cost, QA outcome, publication).	37	Recorded below as they complete (run IDs, stages, cost, QA outcome, publication).

added scripts/ci.sh +13 −0

++#!/bin/bash
++# CI entry point (no hosted CI: spbgit is a bare git server). Run on the laptop or a node before pushing/deploying:
++#   lint → typecheck → unit → integration (needs TEST_DATABASE_URL, default local autoscholar_test) → audit → build web
++set -euo pipefail
++export CI=true
++cd "$(dirname "$0")/.."
++echo "== lint";        pnpm exec biome check .
++echo "== typecheck";   pnpm -r --filter './packages/**' --filter './services/**' build >/dev/null && (cd apps/web && pnpm typecheck)
++echo "== unit";        pnpm vitest run --project unit
++echo "== integration"; AUTOSCHOLAR_INTEGRATION=1 pnpm vitest run --project integration
++echo "== audit";       pnpm audit --prod
++echo "== build web";   (cd apps/web && pnpm build >/dev/null) && echo "web build ok"
++echo "CI OK"

spb/autoscholar

CI script; test report: production smoke/load/a11y/audit

Theme