CI script; test report: production smoke/load/a11y/audit

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Simon-Pierre Boucher committed 4 days ago (Oct 30, 2026) parent 870f9a1 Browse files

2 changed files +21 −0

modified docs/TEST_REPORT.md +8 −0

		`@@ -24,6 +24,14 @@ Updated 2026-10-30. Every line below was actually executed; results are copied,`
24	24	\| Backup + restore \| `scripts/backup.sh` → pg_dump + rsync to `M3U96a:~/backups/autoscholar` (dumps listed offsite); `scripts/restore-test.sh` restored into `autoscholar_restore`, counted rows, verified artifact digests, dropped the DB \|
25	25	\| Fault found and fixed during the first live run \| second upload of a changed artifact within one attempt collided with the write-once store → HTTP 500 → runner reported a failed attempt → scheduler retried from the preflight checkpoint on attempt 2 (recovery path worked as designed). Fix: per-version storage keys; redeployed with `scripts/deploy-control-plane.sh` (≈5 s gap) \|
26	26
	27	+## Production smoke, load and accessibility (2026-10-30, over the LAN)
	28	+
	29	+- All 15 public routes return 200 (home, research, topics, series, about, methodology, infrastructure, transparency, 3 legal pages, feed.xml, sitemap.xml, robots.txt) and an unknown paper returns 404; `robots.txt` disallows `/admin` and `/api`.
	30	+- All 12 admin pages return 200 with a valid session; signed-out admin pages redirect (307) to login; admin APIs return 401.
	31	+- Load (20 concurrent clients, 15 s, mixed public pages/APIs from M1M32): 14 683 requests, 979 req/s, p50 17 ms, p95 39 ms, p99 47 ms, max 236 ms; the only errors were HTTP 429 from the public rate limiter (600/min per address) — confirmed by a second 5 s burst returning 100 % 429.
	32	+- Accessibility: axe-core wcag2a/aa on 11 public pages in the e2e suite (0 violations); keyboard skip link and reduced-motion verified.
	33	+- Dependency audit: `pnpm audit --prod` → 0 known vulnerabilities after upgrading pdfjs-dist to 6.4 (GHSA-hq66-cqwq-w95j).
	34	+
27	35	## Live research runs
28	36
29	37	Recorded below as they complete (run IDs, stages, cost, QA outcome, publication).

added scripts/ci.sh +13 −0

		`@@ -0,0 +1,13 @@`
	1	+#!/bin/bash
	2	+# CI entry point (no hosted CI: spbgit is a bare git server). Run on the laptop or a node before pushing/deploying:
	3	+# lint → typecheck → unit → integration (needs TEST_DATABASE_URL, default local autoscholar_test) → audit → build web
	4	+set -euo pipefail
	5	+export CI=true
	6	+cd "$(dirname "$0")/.."
	7	+echo "== lint"; pnpm exec biome check .
	8	+echo "== typecheck"; pnpm -r --filter './packages/' --filter './services/' build >/dev/null && (cd apps/web && pnpm typecheck)
	9	+echo "== unit"; pnpm vitest run --project unit
	10	+echo "== integration"; AUTOSCHOLAR_INTEGRATION=1 pnpm vitest run --project integration
	11	+echo "== audit"; pnpm audit --prod
	12	+echo "== build web"; (cd apps/web && pnpm build >/dev/null) && echo "web build ok"
	13	+echo "CI OK"
	14

spb/autoscholar

CI script; test report: production smoke/load/a11y/audit

Theme