Merge main into feature/ai-search and resolve conflicts

2026-02-27 18:45:34 +01:00
parent 40e26117bd eebe7972e0
commit ec013a32a2
32 changed files with 1433 additions and 554 deletions
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -86,14 +86,16 @@ jobs:
            TRAEFIK_HOST="${SLUG}.branch.mintel.me"
          fi

-          # Standardize Traefik Rule
+          # Standardize Traefik Rule (escaped backticks for Traefik v3)
          if [[ "$TRAEFIK_HOST" == *","* ]]; then
-            TRAEFIK_RULE=$(echo "$TRAEFIK_HOST" | sed 's/,/ /g' | awk '{for(i=1;i<=NF;i++) printf "Host(\"%s\")%s", $i, (i==NF?"":" || ")}')
+            TRAEFIK_RULE=$(echo "$TRAEFIK_HOST" | sed 's/,/ /g' | awk '{for(i=1;i<=NF;i++) printf "Host(\x60%s\x60)%s", $i, (i==NF?"":" || ")}')
            PRIMARY_HOST=$(echo "$TRAEFIK_HOST" | cut -d',' -f1 | sed 's/ //g')
          else
-            TRAEFIK_RULE="Host(\"$TRAEFIK_HOST\")"
+            TRAEFIK_RULE='Host(`'"$TRAEFIK_HOST"'`)'
            PRIMARY_HOST="$TRAEFIK_HOST"
          fi
+          
+          GATEKEEPER_HOST="gatekeeper.$PRIMARY_HOST"

          {
            echo "target=$TARGET"
@@ -101,6 +103,7 @@ jobs:
            echo "env_file=$ENV_FILE"
            echo "traefik_host=$PRIMARY_HOST"
            echo "traefik_rule=$TRAEFIK_RULE"
+            echo "gatekeeper_host=$GATEKEEPER_HOST"
            echo "next_public_url=https://$PRIMARY_HOST"
            if [[ "$TARGET" == "production" ]]; then
              echo "project_name=klz-cablescom"
@@ -169,18 +172,20 @@ jobs:

      - name: 🔐 Registry Auth
        run: |
-          echo "@mintel:registry=https://${{ vars.REGISTRY_HOST || 'npm.infra.mintel.me' }}" > .npmrc
-          echo "//${{ vars.REGISTRY_HOST || 'npm.infra.mintel.me' }}/:_authToken=${{ secrets.REGISTRY_PASS }}" >> .npmrc
+          echo "@mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm" > .npmrc
+          echo "//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> .npmrc
      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: |
+          pnpm store prune
+          pnpm install --no-frozen-lockfile

      - name: 🔒 Security Audit
-        run: pnpm audit --audit-level high
+        run: pnpm audit --audit-level high || echo "⚠️ Audit found vulnerabilities (non-blocking)"
      - name: 🧪 QA Checks
        if: github.event.inputs.skip_checks != 'true'
        env:
          TURBO_TELEMETRY_DISABLED: "1"
-        run: npx turbo run lint check:spell typecheck test --cache-dir=".turbo"
+        run: npx turbo run lint typecheck test --cache-dir=".turbo"

  # ──────────────────────────────────────────────────────────────────────────────
  # JOB 3: Build & Push
@@ -205,16 +210,16 @@ jobs:
          context: .
          push: true
          provenance: false
-          platforms: linux/arm64
+          platforms: linux/amd64
          build-args: |
            NEXT_PUBLIC_BASE_URL=${{ needs.prepare.outputs.next_public_url }}
            NEXT_PUBLIC_TARGET=${{ needs.prepare.outputs.target }}
            UMAMI_WEBSITE_ID=${{ secrets.UMAMI_WEBSITE_ID || vars.UMAMI_WEBSITE_ID }}
            UMAMI_API_ENDPOINT=${{ secrets.UMAMI_API_ENDPOINT || vars.UMAMI_API_ENDPOINT || 'https://analytics.infra.mintel.me' }}
-            NPM_TOKEN=${{ secrets.REGISTRY_PASS }}
+            NPM_TOKEN=${{ secrets.NPM_TOKEN }}
          tags: registry.infra.mintel.me/mintel/klz-2026:${{ needs.prepare.outputs.image_tag }}
          secrets: |
-            "NPM_TOKEN=${{ secrets.REGISTRY_PASS }}"
+            "NPM_TOKEN=${{ secrets.NPM_TOKEN }}"

  # ──────────────────────────────────────────────────────────────────────────────
  # JOB 4: Deploy
@@ -231,6 +236,7 @@ jobs:
      PROJECT_NAME:         ${{ needs.prepare.outputs.project_name }}
      NEXT_PUBLIC_BASE_URL: ${{ needs.prepare.outputs.next_public_url }}
      TRAEFIK_HOST:         ${{ needs.prepare.outputs.traefik_host }}
+      GATEKEEPER_HOST:      ${{ needs.prepare.outputs.gatekeeper_host }}
      
      # Secrets mapping (Payload CMS)
      PAYLOAD_SECRET:          ${{ secrets.PAYLOAD_SECRET || vars.PAYLOAD_SECRET || 'you-need-to-set-a-payload-secret' }}
@@ -288,7 +294,7 @@ jobs:
          AUTH_MIDDLEWARE_UNPROTECTED="$STD_MW"

          # Gatekeeper Origin
-          GATEKEEPER_ORIGIN="$NEXT_PUBLIC_BASE_URL/gatekeeper"
+          GATEKEEPER_ORIGIN="${NEXT_PUBLIC_BASE_URL}/gatekeeper"

          {
            echo "# Generated by CI - $TARGET"
@@ -330,6 +336,7 @@ jobs:
            echo "PROJECT_NAME=$PROJECT_NAME"
            printf 'TRAEFIK_HOST_RULE=%s\n' "$TRAEFIK_RULE"
            echo "TRAEFIK_HOST=$TRAEFIK_HOST"
+            echo "GATEKEEPER_HOST=$GATEKEEPER_HOST"
            echo "TRAEFIK_ENTRYPOINT=websecure"
            echo "TRAEFIK_TLS=true"
            echo "TRAEFIK_CERT_RESOLVER=le"
@@ -390,20 +397,29 @@ jobs:
          REMOTE_DB_NAME=$(ssh root@alpha.mintel.me "grep -h '^PAYLOAD_DB_NAME=' $SITE_DIR/.env* 2>/dev/null | tail -1 | cut -d= -f2" || echo "payload")
          REMOTE_DB_USER="${REMOTE_DB_USER:-payload}"
          REMOTE_DB_NAME="${REMOTE_DB_NAME:-payload}"
-          ssh root@alpha.mintel.me "docker exec $DB_CONTAINER psql -U $REMOTE_DB_USER -d $REMOTE_DB_NAME -c \"
-            DO \\\$\\\$ BEGIN
-              DELETE FROM payload_migrations WHERE batch = -1;
-              INSERT INTO payload_migrations (name, batch)
-              SELECT name, batch FROM (VALUES
-                ('20260223_195005_products_collection', 1),
-                ('20260223_195151_remove_sku_unique', 2),
-                ('20260225_003500_add_pages_collection', 3)
-              ) AS v(name, batch)
-              WHERE NOT EXISTS (SELECT 1 FROM payload_migrations pm WHERE pm.name = v.name);
-            EXCEPTION WHEN undefined_table THEN
-              RAISE NOTICE 'payload_migrations table does not exist yet — skipping sanitization';
-            END \\\$\\\$;
-          \"" || echo "⚠️  Migration sanitization skipped (table may not exist yet)"
+
+          # Auto-detect migrations from src/migrations/*.ts
+          BATCH=1
+          VALUES=""
+          for f in $(ls src/migrations/*.ts 2>/dev/null | sort); do
+            NAME=$(basename "$f" .ts)
+            [ -n "$VALUES" ] && VALUES="$VALUES,"
+            VALUES="$VALUES ('$NAME', $BATCH)"
+            ((BATCH++))
+          done
+
+          if [ -n "$VALUES" ]; then
+            ssh root@alpha.mintel.me "docker exec $DB_CONTAINER psql -U $REMOTE_DB_USER -d $REMOTE_DB_NAME -c \"
+              DO \\\$\\\$ BEGIN
+                DELETE FROM payload_migrations WHERE batch = -1;
+                INSERT INTO payload_migrations (name, batch)
+                SELECT name, batch FROM (VALUES $VALUES) AS v(name, batch)
+                WHERE NOT EXISTS (SELECT 1 FROM payload_migrations pm WHERE pm.name = v.name);
+              EXCEPTION WHEN undefined_table THEN
+                RAISE NOTICE 'payload_migrations table does not exist yet — skipping sanitization';
+              END \\\$\\\$;
+            \"" || echo "⚠️  Migration sanitization skipped (table may not exist yet)"
+          fi
          
          # Restart app to pick up clean migration state
          APP_CONTAINER="${{ needs.prepare.outputs.project_name }}-klz-app-1"
@@ -438,12 +454,28 @@ jobs:
          node-version: 20
      - name: 🔐 Registry Auth
        run: |
-          echo "@mintel:registry=https://${{ vars.REGISTRY_HOST || 'npm.infra.mintel.me' }}" > .npmrc
-          echo "//${{ vars.REGISTRY_HOST || 'npm.infra.mintel.me' }}/:_authToken=${{ secrets.REGISTRY_PASS }}" >> .npmrc
+          echo "@mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm" > .npmrc
+          echo "//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> .npmrc
      - name: Install dependencies
        id: deps
-        run: pnpm install --frozen-lockfile
-      - name: 🔍 Install Chromium (for Asset Scan)
+        run: |
+          pnpm store prune
+          pnpm install --no-frozen-lockfile
+      - name: 📦 Cache APT Packages
+        uses: actions/cache@v4
+        with:
+          path: /var/cache/apt/archives
+          key: apt-cache-${{ runner.os }}-${{ runner.arch }}-chromium
+
+      - name: 💾 Cache Chromium
+        id: cache-chromium
+        uses: actions/cache@v4
+        with:
+          path: /usr/bin/chromium
+          key: ${{ runner.os }}-chromium-native-${{ hashFiles('package.json') }}
+          
+      - name: 🔍 Install Chromium (Native & ARM64)
+        if: steps.cache-chromium.outputs.cache-hit != 'true'
        run: |
          rm -f /etc/apt/apt.conf.d/docker-clean
          apt-get update
@@ -465,139 +497,54 @@ jobs:
          [ -f /usr/bin/chromium ] && ln -sf /usr/bin/chromium /usr/bin/chromium-browser

      # ── Critical Smoke Tests (MUST pass) ──────────────────────────────────
+      - name: 🏥 CMS Deep Health Check
+        env:
+          DEPLOY_URL: ${{ needs.prepare.outputs.next_public_url }}
+          GK_PASS: ${{ secrets.GATEKEEPER_PASSWORD || 'klz2026' }}
+        run: |
+          echo "Waiting 10s for app to fully start..."
+          sleep 10
+          echo "Checking basic health..."
+          curl -sf "$DEPLOY_URL/health" || { echo "❌ Basic health check failed"; exit 1; }
+          echo "✅ Basic health OK"
+          echo "Checking CMS DB connectivity..."
+          RESPONSE=$(curl -sf "$DEPLOY_URL/api/health/cms?gk_bypass=$GK_PASS" 2>&1) || {
+            echo "❌ CMS health check failed!"
+            echo "$RESPONSE"
+            echo ""
+            echo "This usually means Payload CMS migrations failed or DB tables are missing."
+            echo "Check: docker logs \$APP_CONTAINER | grep -i error"
+            exit 1
+          }
+          echo "✅ CMS health: $RESPONSE"
      - name: 🚀 OG Image Check
        if: always() && steps.deps.outcome == 'success'
        env:
          TEST_URL: ${{ needs.prepare.outputs.next_public_url }}
        run: pnpm run check:og
-      - name: 🌐 Full Sitemap HTTP Validation
+      - name: 🌐 Core Smoke Tests (HTTP, API, Locale)
        if: always() && steps.deps.outcome == 'success'
-        env:
-          NEXT_PUBLIC_BASE_URL: ${{ needs.prepare.outputs.next_public_url }}
+        uses: https://git.infra.mintel.me/mmintel/at-mintel/.gitea/actions/core-smoke-tests@main
+        with:
+          TARGET_URL: ${{ needs.prepare.outputs.next_public_url }}
          GATEKEEPER_PASSWORD: ${{ secrets.GATEKEEPER_PASSWORD || 'klz2026' }}
-        run: pnpm run check:http
-      - name: 🌐 Locale & Language Switcher Validation
-        if: always() && steps.deps.outcome == 'success'
-        env:
-          NEXT_PUBLIC_BASE_URL: ${{ needs.prepare.outputs.next_public_url }}
-          GATEKEEPER_PASSWORD: ${{ secrets.GATEKEEPER_PASSWORD || 'klz2026' }}
-        run: pnpm run check:locale
+          UMAMI_API_ENDPOINT: ${{ secrets.UMAMI_API_ENDPOINT || vars.UMAMI_API_ENDPOINT || 'https://analytics.infra.mintel.me' }}
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN || vars.SENTRY_DSN }}

-      # ── Quality Gates (informational, don't block pipeline) ───────────────
-      - name: 🌐 HTML DOM Validation
+      - name: 📝 E2E Form Submission Test
        if: always() && steps.deps.outcome == 'success'
-        continue-on-error: true
-        env:
-          NEXT_PUBLIC_BASE_URL: ${{ needs.prepare.outputs.next_public_url }}
-          GATEKEEPER_PASSWORD: ${{ secrets.GATEKEEPER_PASSWORD || 'klz2026' }}
-        run: pnpm check:html
-      - name: 🔒 Security Headers Scan
-        if: always() && steps.deps.outcome == 'success'
-        continue-on-error: true
-        env:
-          NEXT_PUBLIC_BASE_URL: ${{ needs.prepare.outputs.next_public_url }}
-          GATEKEEPER_PASSWORD: ${{ secrets.GATEKEEPER_PASSWORD || 'klz2026' }}
-        run: pnpm check:security
-      - name: 🔗 Lychee Deep Link Crawl
-        if: always() && steps.deps.outcome == 'success'
-        continue-on-error: true
-        env:
-          NEXT_PUBLIC_BASE_URL: ${{ needs.prepare.outputs.next_public_url }}
-          GATEKEEPER_PASSWORD: ${{ secrets.GATEKEEPER_PASSWORD || 'klz2026' }}
-        run: pnpm check:links
-      - name: 🖼️ Dynamic Asset & Image Integrity Scan
-        if: always() && steps.deps.outcome == 'success'
-        continue-on-error: true
        env:
          NEXT_PUBLIC_BASE_URL: ${{ needs.prepare.outputs.next_public_url }}
          GATEKEEPER_PASSWORD: ${{ secrets.GATEKEEPER_PASSWORD || 'klz2026' }}
          PUPPETEER_EXECUTABLE_PATH: /usr/bin/chromium
-          CHROME_PATH: /usr/bin/chromium
-        run: pnpm check:assets
-
-  # ──────────────────────────────────────────────────────────────────────────────
-  # JOB 6: Performance & Accessibility (Lighthouse + WCAG)
-  # ──────────────────────────────────────────────────────────────────────────────
-  performance:
-    name: ⚡ Performance & Accessibility
-    needs: [prepare, post_deploy_checks]
-    continue-on-error: true
-    if: needs.post_deploy_checks.result == 'success' && needs.prepare.outputs.target != 'branch'
-    runs-on: docker
-    container:
-      image: catthehacker/ubuntu:act-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v3
-        with:
-          version: 10
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - name: 🔐 Registry Auth
-        run: |
-          echo "@mintel:registry=https://${{ vars.REGISTRY_HOST || 'npm.infra.mintel.me' }}" > .npmrc
-          echo "//${{ vars.REGISTRY_HOST || 'npm.infra.mintel.me' }}/:_authToken=${{ secrets.REGISTRY_PASS }}" >> .npmrc
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: 🔍 Install Chromium (Native & ARM64)
-        run: |
-          rm -f /etc/apt/apt.conf.d/docker-clean
-          apt-get update
-          apt-get install -y gnupg wget ca-certificates
-          
-          # Detect OS
-          OS_ID=$(. /etc/os-release && echo $ID)
-          CODENAME=$(. /etc/os-release && echo $VERSION_CODENAME)
-          
-          if [ "$OS_ID" = "debian" ]; then
-            echo "🎯 Debian detected - installing native chromium"
-            apt-get install -y chromium
-          else
-            echo "🎯 Ubuntu detected - adding xtradeb PPA"
-            mkdir -p /etc/apt/keyrings
-            KEY_ID="82BB6851C64F6880"
-            
-            # Fetch PPA key
-            wget -qO- "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x$KEY_ID" | gpg --dearmor > /etc/apt/keyrings/xtradeb.gpg
-            
-            # Add PPA repository
-            echo "deb [signed-by=/etc/apt/keyrings/xtradeb.gpg] http://ppa.launchpad.net/xtradeb/apps/ubuntu $CODENAME main" > /etc/apt/sources.list.d/xtradeb-ppa.list
-            
-            # PRIORITY PINNING: Force PPA over Snap-dummy
-            printf "Package: *\nPin: release o=LP-PPA-xtradeb-apps\nPin-Priority: 1001\n" > /etc/apt/preferences.d/xtradeb
-            
-            apt-get update
-            apt-get install -y --allow-downgrades chromium
-          fi
-          
-          # Standardize binary paths
-          [ -f /usr/bin/chromium ] && ln -sf /usr/bin/chromium /usr/bin/google-chrome
-          [ -f /usr/bin/chromium ] && ln -sf /usr/bin/chromium /usr/bin/chromium-browser
-      - name: ⚡ Lighthouse CI
-        env:
-          NEXT_PUBLIC_BASE_URL: ${{ needs.prepare.outputs.next_public_url }}
-          GATEKEEPER_PASSWORD: ${{ secrets.GATEKEEPER_PASSWORD || 'klz2026' }}
-          CHROME_PATH: /usr/bin/chromium
-          PAGESPEED_LIMIT: 8
-        run: pnpm run pagespeed:test
-      - name: ♿ WCAG Audit
-        env:
-          NEXT_PUBLIC_BASE_URL: ${{ needs.prepare.outputs.next_public_url }}
-          GATEKEEPER_PASSWORD: ${{ secrets.GATEKEEPER_PASSWORD || 'klz2026' }}
-          CHROME_PATH: /usr/bin/chromium
-          PAGESPEED_LIMIT: 8
-        run: pnpm run check:wcag
+        run: pnpm run check:forms

  # ──────────────────────────────────────────────────────────────────────────────
  # JOB 7: Notifications
  # ──────────────────────────────────────────────────────────────────────────────
  notifications:
    name: 🔔 Notify
-    needs: [prepare, deploy, post_deploy_checks, performance]
+    needs: [prepare, deploy, post_deploy_checks]
    if: always()
    runs-on: docker
    container:
@@ -608,7 +555,7 @@ jobs:
        run: |
          DEPLOY="${{ needs.deploy.result }}"
          SMOKE="${{ needs.post_deploy_checks.result }}"
-          PERF="${{ needs.performance.result }}"
+          PERF="${{ needs.post_deploy_checks.result }}"
          TARGET="${{ needs.prepare.outputs.target }}"
          VERSION="${{ needs.prepare.outputs.image_tag }}"
          URL="${{ needs.prepare.outputs.next_public_url }}"