Harden CI deployment and e2e checks

.github/workflows/ci.yml

@@ -12,10 +12,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
           cache: 'npm'
@@ -40,10 +40,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
           cache: 'npm'
@@ -54,17 +54,11 @@ jobs:
       - name: Install Playwright Chromium
         run: npx playwright install --with-deps chromium
 
-      # Playwright serves dist/ via `npm run preview` when CI is set, so the
-      # app must be built first. Without this the preview server has nothing
-      # to serve and every test times out waiting for the app to render.
-      - name: Build
-        run: npm run build
-
       - name: Run Playwright tests
-        run: npx playwright test --project=chromium --grep-invert @visual
+        run: npm run test:e2e:ci
 
       - name: Upload Playwright report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: playwright-report
@@ -83,19 +77,18 @@ jobs:
       - name: Check Cloudflare credentials
         id: check_credentials
         run: |
-          if [ -n "$CLOUDFLARE_API_TOKEN" ]; then
-            echo "configured=true" >> "$GITHUB_OUTPUT"
-            echo "Cloudflare credentials detected; proceeding with deployment."
-          else
-            echo "configured=false" >> "$GITHUB_OUTPUT"
-            echo "Deploy skipped: no Cloudflare credentials configured."
+          if [ -z "$CLOUDFLARE_API_TOKEN" ] || [ -z "$CLOUDFLARE_ACCOUNT_ID" ]; then
+            echo "Error: Missing Cloudflare credentials. Both CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID must be set." >&2
+            exit 1
           fi
+          echo "configured=true" >> "$GITHUB_OUTPUT"
+          echo "Cloudflare credentials detected; proceeding with deployment."
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
           cache: 'npm'

MAINTAINERS.md

@@ -35,6 +35,7 @@ Starts the Vite dev server at `http://localhost:3000`.
 - **Unit test coverage**: `npm run test:coverage`
 - **End-to-end tests (Playwright)**: `npm run test:e2e`
 - **End-to-end tests (interactive UI)**: `npm run test:e2e:ui`
+- **End-to-end tests (CI/production preview)**: `npm run test:e2e:ci` (builds DREAM first, then runs non-visual Chromium tests against `npm run preview` with `CI=1`)
 
 ### Build & Preview
 - **Production build**: `npm run build` (runs `prebuild` changelog sync then `vite build`)
@@ -55,7 +56,7 @@ Starts the Vite dev server at `http://localhost:3000`.
 4. The GitHub Actions workflow (`.github/workflows/ci.yml`) runs `test` and `e2e` jobs in parallel.
 5. Upon successful completion of both test suites, the `deploy` job builds the application, strips sourcemaps (`find dist -name '*.map' -delete`), and publishes to Cloudflare Pages using `CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID`.
 
-> **Note**: If `CLOUDFLARE_API_TOKEN` is not configured in GitHub repository secrets, the `deploy` job skips cleanly without failing the CI run.
+> **Note**: Both `CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID` must be configured in GitHub repository secrets. If either credential is missing, the `deploy` job fails loudly.
 
 ### Break-Glass Path (Emergency Manual Deployment)
 If GitHub Actions is down, credentials fail, or an urgent hotfix must be shipped immediately:

README.md

@@ -99,6 +99,7 @@ If port 3000 is already in use, Vite may choose the next available port. Check t
 - `npm run lint` — run ESLint
 - `npm run test:unit` — run unit/component tests
 - `npm run test:e2e` — run Playwright tests
+- `npm run test:e2e:ci` — build DREAM first and run non-visual Chromium e2e tests against the production preview
 - `npm run test:coverage` — generate local coverage reports
 - `npm run build` — sync changelog data and build production assets
 - `npm run preview` — preview the production build locally
@@ -154,7 +155,7 @@ src/
 
 ## Known Operational Notes
 
-- GitHub Actions validate pushes and pull requests to `main`, with automated deployment to Cloudflare Pages on push to `main` when `CLOUDFLARE_API_TOKEN` is configured.
+- GitHub Actions validate pushes and pull requests to `main`, with automated deployment to Cloudflare Pages on push to `main` when Cloudflare credentials (`CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID`) are configured.
 - Maintainer runbook and testing scripts are documented in [MAINTAINERS.md](MAINTAINERS.md).
 - Succession inventory, credential rotation, and continuity plans are documented in [HANDOVER.md](HANDOVER.md).
 - Branch protection is not configured because GitHub reports it is unavailable for this private repository without GitHub Pro.

package.json

@@ -20,7 +20,8 @@
     "test:coverage": "vitest --coverage",
     "test:unit": "vitest run",
     "test:e2e": "playwright test",
-    "test:e2e:ui": "playwright test --ui"
+    "test:e2e:ui": "playwright test --ui",
+    "test:e2e:ci": "npm run build && CI=1 playwright test --project=chromium --grep-invert @visual"
   },
   "dependencies": {
     "@radix-ui/react-accordion": "^1.2.12",