TL;DR: shaghafna-e2e now runs standalone, has a write guard so prod is smoke-only, checks every API answer against openapi.yaml, writes a coverage summary each run, and has CI and docs. Everything is in 5 local commits on main, not pushed. Nothing has run in a browser yet; the more journey and API tests and the fill sizes are next, once the local stack is running.
I've finished Steps 0, 1, 2, 3, 6 and 8 of the plan, and the CI workflow files from Step 7. Steps 4 (more journeys and API tests) and 5 (`FILL_SIZE`) are next and need a running local app to check against. There are 5 local commits on `main`, nothing pushed. `origin` is added, `dev` is deleted, and `main` is the only branch.
What's in place now
- Runs without the sibling folders: each target reads its own `.env.local` / `.env.dev` / `.env.prod` (template: `.env.example`). The Paymob test keys now come from there instead of the backend's `.env`; I created `.env.local` from your backend values. For dev and prod, `yarn sources` downloads the frontend text, the page list and the backend's `openapi.yaml` at the exact commit dev is running.
- Write guard: on prod or any unknown host, only the `meta` and `smoke` projects exist. On top of that, the API client refuses any call that changes data except login, logout and refresh.
- New layout: `meta`, `smoke`, `setup`, `crawl`, `journeys`, `admin`, `api`, `forms` and `fill`. Your existing specs moved in unchanged.
- One list of pages: `support/routes.ts` lists every web page and who may open it. The crawl and a new access test (guest, unverified, owner, admin for every page) both read it.
- Contract check: every API answer the tests see is checked against `openapi.yaml`.
- Run summary: each run writes `reports/<time>-<target>/summary.md`. It has the backend version, results per area, failures, contract mismatches, how many of the 295 API operations were reached, and accessibility (axe) counts.
- Tooling: ESLint and Prettier copied from the backend (width 80, so most files were reformatted), husky hooks, and dependabot.
- CI: `ci.yml` checks the suite on every push. `e2e.yml` runs against dev nightly, on demand, and when a deploy triggers it; prod runs smoke only.
- Docs: a short `README.md`, `docs/setup.md`, `docs/writing-tests.md`, `docs/coverage.md`, `docs/ci.md`, `docs/DEVELOPER_NOTES.md`, plus `AGENTS.md` and `CLAUDE.md`.
What I ran
- `yarn meta` passes.
- The guard works: prod lists only 28 smoke and meta tests, while local and dev list 1,064.
- The route check failed when I added a fake page.
- While I was working, the frontend added four pages (KYC, NDA, profile, verification) and removed three admin pages; the check caught all seven. I updated the list.
- Nothing has run in a browser yet. The Chromium download for Playwright 1.65 is still crawling along in the background, and the local API and web app aren't running. The smoke run against dev failed only because the browser is missing.
Where I changed the plan
- I downgraded TypeScript from 7 to 6.0.3, because the ESLint TypeScript tooling only supports versions below 6.1 (same reason as the backend). This is noted in `DEVELOPER_NOTES.md`.
- The page check is a test in the `meta` project instead of a separate script.
- `setup` looks up existing ids and doesn't create starter data. A page with no data yet is skipped, with a hint to run `yarn fill`.
- I moved your local sign-ins and fill data into `.auth/local/` and `.data/local/`.
What I need from you
1. Steps 4 and 5: can you start the local stack (frontend `yarn dev`, backend `yarn dev` + `yarn dev:worker`), or may I start it? I'll then test one spec at a time, as you asked.
2. Push: say when, after you've checked the commits.
3. GitHub secrets for the `dev` and `production` environments: the list is in `docs/ci.md`. The most important is `SOURCES_TOKEN`; CI can't do anything without it.
4. Do you agree with moving the `frontend-update` skill into the backend repo? It reads the backend's history, so it belongs there.
5. The deploy trigger step for the backend and frontend `deploy.yml` is written in `docs/ci.md`, but I haven't added it to those repos yet.
TL;DR: shaghafna-e2e now runs standalone, has a write guard so prod is smoke-only, checks every API answer against openapi.yaml, writes a coverage summary each run, and has CI and docs. Everything is in 5 local commits on `main`, not pushed. Nothing has run in a browser yet; the more journey and API tests and the fill sizes are next, once the local stack is running.
Your message reaches the owner without your name, and nobody else sees it.
Education · Eastern Province, Saudi Arabia
العقدبيقول newest و«first ،»Newest والكود بيرتب االتنينبـ updatedAt ، وقايمة صاحب المشروع بتتجاهل sort. فأي تعديل بيطّلع الصف لفوق، والتصميم كاتب «األحدثأوًلا» وبيعرض تاريخ اإلنشاء. عايزين الترتيب باإلنشاء،أو تأكيد وتصحيح في العقد
