Run the workflow on pull_request too, so tests + build + Trivy must pass before main can be
merged (branch protection requires this check). Push the image only on a real push to main —
never from a PR. Also standardises the workflow across all apps (three had drifted).
The image build runs 'mvn -DskipTests' and the workflow was only build -> Trivy -> push, so
no app test has ever run in CI — only Trivy gated a merge. The platform contract tests added
in 0.1.9 were not running either, which defeated their purpose.
They cannot run inside 'docker build' — Testcontainers needs a Docker daemon and a build has
none. Maven runs as a sibling container instead, mounting the workspace volume act_runner
gave this job (matched on GITHUB_WORKSPACE, since it is mounted at the full repo path rather
than at /workspace) and sharing the host network so published test ports resolve as localhost.
Verified on itsthevine before rolling out here: 33 tests ran, and a deliberately failing test
failed the run at the Test step with the registry digest unchanged — no image published.
The merged Renovate bumps were undone when I rsync'd a local tree over these repos while
pushing the contract tests — that local package.json was a pre-merge backup I had kept so
the PRs would be the source of the versions.
Re-applied and verified from a clean install (rm -rf node_modules package-lock.json &&
npm install && tsc && vite build), which is also what regenerates a lock file consistent
with all the bumps at once.
PlatformWebContract asserts what this app must do because it is on the platform: an /api
path matching no controller 404s rather than returning the SPA, health is UP, the liveness
and readiness probes exist, and a client-side route forwards to the shell. That first one
shipped broken to six live sites and was found by typing a URL by hand; now it fails a
build instead.
renovate.json is three lines pointing at austin/renovate-config. The rules were copied per
repo, so they matched only by luck and a change was six edits.
Platform 0.1.9.
TS7 errors with 'Option baseUrl has been removed'. The paths mapping already points at
./src/*, which resolves relative to this file without it, and TS 5.9 accepts the same
config — so this lands safely ahead of the TypeScript 7 bump.
Same site — glass header, bento grid, hero drift, dark mode — with three things fixed
on the way:
- Tailwind and lucide came from CDNs on every page load, and the fonts from Google. All
are now built in or self-hosted, so the site owes nothing to third parties at runtime.
- The hero and bento photographs were hot-linked from Unsplash. They are re-encoded to
webp and served from the MinIO bucket with a year-long cache.
- The ministries and labs were hard-coded in the markup, so launching a ministry meant
editing HTML. They now come from /api/network.
The mobile menu button also opens something now; it did nothing before.
austin