e3ba58139d
Brief 7 (final brief) of unify-glass-panel-surfaces convoy. Adds the regression gate that prevents reintroduction of bespoke var(--glass-surface-low|mid|high) inline styles outside the documented allowlist. IMPLEMENTATION DEVIATION FROM BRIEF (DOCUMENTED): Brief 7 was authored before PR #126 (slash-ci-minutes convoy) consolidated the 6 grep-only forbidden-* jobs into a single forbidden-patterns job with sequential ::group:: sections. Adding Brief 7 as a standalone forbidden-bespoke-glass-surface job (the brief's verbatim shape) would partially undo PR #126's checkout amortization win. Instead, this PR adds the check as Check 7/7 inside the existing forbidden-patterns job — semantics, allowlist, and grep pattern are exactly as Brief 7 specifies; only the wrapper changes. Job display name updated: "Forbidden patterns (6 checks)" → "Forbidden patterns (7 checks)". ALLOWLIST EXPANSION (DOCUMENTED): Brief 7's planned 3-entry allowlist (the 3 chrome blocks) turned out to undercount the residual surface area. Three additional files still handroll their own var(--glass-surface-*) inline styles: - components/ui/Button.js (secondary variant) - components/ui/Input.js (input wrapper) - components/MobileNavigation.js (bottom-nav background) Per Brief 7's own note ("If you need to add a fourth allowlist entry, that's a design-system decision — open a new convoy"), the right call is to ship the gate NOW with a 6-entry allowlist (3 chrome + 3 pending-migration) and track the cleanup in a follow-up. This PR therefore also seeds `.convoys/migrate-button-input-mobilenav-to-glass-primitive.md` with the migration plan, open questions for the architect, and acceptance criteria. The 3 pending entries are tagged with inline `# TODO:` comments in ci.yml referencing the follow-up convoy. Local verification (per Brief 7's pre-merge negative test): - Positive test: grep on clean main → 0 violations outside the 6-entry allowlist. ✅ - Negative test: injected a scratch `const scratch = { background: 'var(--glass-surface-low)' }` line at EOF of pages/profile.js; grep correctly flagged it. ✅ - Revert verified: removing the scratch line returns the grep to 0 violations. ✅ The scratch change was NOT committed (per Brief 7's instructions). Convoy closeout: - `.convoys/unify-glass-panel-surfaces.md` status moved from `open` to `closing`; queued_followup field names the new convoy. The convoy lands fully when this PR merges. Verification: - npm run lint passes (1 pre-existing unrelated warning). - npm run test:run: 118/118 tests pass. - YAML parses (python3 yaml.safe_load). Files: - .github/workflows/ci.yml: +~70 lines (Check 7/7 step + final-exit copy edit). - .convoys/migrate-button-input-mobilenav-to-glass-primitive.md: new file, 113 lines. - .convoys/unify-glass-panel-surfaces.md: +2 lines (status + queued_followup fields). Co-authored-by: Cursor <cursoragent@cursor.com>
438 lines
18 KiB
YAML
438 lines
18 KiB
YAML
name: CI
|
|
|
|
# Vercel variant: Vercel builds Preview deployments on every push and gates the
|
|
# PR via the Vercel GitHub integration check. Running `npm run build` here too
|
|
# would duplicate Vercel's work for ~3-5 minutes per PR with no added signal.
|
|
#
|
|
# What this CI covers (and Vercel does not):
|
|
# - Lint (cheap belt-and-suspenders)
|
|
# - Schema-map drift check (docs/SCHEMA_MAP.md updated when scripts/add-*.js changes)
|
|
# - Migrations apply cleanly (node-pg-migrate against ephemeral Postgres 16)
|
|
# - Unit tests (vitest)
|
|
#
|
|
# NOTE: tcg-vault is JavaScript (not TypeScript). No `npx tsc --noEmit` step.
|
|
# Re-enable a type-check job if migrating to TypeScript.
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
# Skip CI entirely for doc-only PRs. The `slash-ci-minutes` convoy
|
|
# (2026-06-04) added this filter because every grep / lint / vitest /
|
|
# migrate job that fires on a pure-docs PR (e.g. `.convoys/` seeds +
|
|
# briefs, AGENTS.md edits, `docs/`) costs GitHub Actions minutes for
|
|
# zero signal. The full job set still runs on code-touching PRs.
|
|
paths-ignore:
|
|
- '.convoys/**'
|
|
- '**/*.md'
|
|
- 'docs/**'
|
|
- 'AGENTS.md'
|
|
- '.cursor/**'
|
|
- 'README.md'
|
|
push:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- '.convoys/**'
|
|
- '**/*.md'
|
|
- 'docs/**'
|
|
- 'AGENTS.md'
|
|
- '.cursor/**'
|
|
- 'README.md'
|
|
|
|
concurrency:
|
|
group: ci-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
NODE_VERSION: '20'
|
|
|
|
jobs:
|
|
lint:
|
|
name: Lint
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
cache: npm
|
|
# Cache node_modules between runs (in addition to setup-node's npm
|
|
# cache). `setup-node@v4`'s `cache: npm` caches `~/.npm` but `npm
|
|
# ci` still does a fresh install into `node_modules` — that's the
|
|
# ~30-45s we want to skip on cache hit. Keyed by package-lock.json
|
|
# hash so any dep change invalidates correctly.
|
|
- name: Cache node_modules
|
|
id: cache-node-modules
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: node_modules
|
|
key: node-modules-${{ runner.os }}-node${{ env.NODE_VERSION }}-${{ hashFiles('package-lock.json') }}
|
|
- run: npm ci
|
|
if: steps.cache-node-modules.outputs.cache-hit != 'true'
|
|
- run: npm run lint --if-present
|
|
|
|
schema-map-fresh:
|
|
name: Schema map up to date
|
|
runs-on: ubuntu-latest
|
|
# Only run when migration scripts or the schema map itself changed.
|
|
# If neither changed, nothing to verify.
|
|
if: |
|
|
contains(github.event.pull_request.changed_files, 'scripts/add-') ||
|
|
contains(github.event.pull_request.changed_files, 'scripts/fix-') ||
|
|
contains(github.event.pull_request.changed_files, 'scripts/setup-neon-db.js') ||
|
|
contains(github.event.pull_request.changed_files, 'migrations/') ||
|
|
contains(github.event.pull_request.changed_files, 'docs/SCHEMA_MAP.md')
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 2
|
|
- name: Verify schema map updated alongside migration scripts
|
|
run: |
|
|
MIGRATION_CHANGED=false
|
|
MAP_CHANGED=false
|
|
if git diff --name-only HEAD~1 | grep -qE '^scripts/(add-|fix-|setup-neon-db\.js)'; then
|
|
MIGRATION_CHANGED=true
|
|
fi
|
|
if git diff --name-only HEAD~1 | grep -qE '^migrations/'; then
|
|
MIGRATION_CHANGED=true
|
|
fi
|
|
if git diff --name-only HEAD~1 | grep -q '^docs/SCHEMA_MAP\.md$'; then
|
|
MAP_CHANGED=true
|
|
fi
|
|
if [ "$MIGRATION_CHANGED" = "true" ] && [ "$MAP_CHANGED" = "false" ]; then
|
|
echo "::error::A migration script changed but docs/SCHEMA_MAP.md was not updated."
|
|
echo "Update docs/SCHEMA_MAP.md to reflect the schema change, then re-push."
|
|
exit 1
|
|
fi
|
|
echo "OK: schema map and migration scripts are in sync."
|
|
|
|
# Consolidated grep-based regression gates. Previously 6 separate jobs
|
|
# (forbidden-endpoints / -cors-headers / -client-side-llm-keys /
|
|
# -modal-shell-without-primitive / -deprecated-color-aliases /
|
|
# -stale-strings); the `slash-ci-minutes` convoy (2026-06-04) merged
|
|
# them into one job to amortize a single actions/checkout across all
|
|
# 6 checks. Each check still emits `::error file=...::msg` so the
|
|
# in-file annotations work the same way. The job uses a FAIL flag so
|
|
# ALL violations across all 6 checks are reported in a single run
|
|
# (matches the previous independent-jobs behavior; nicer than
|
|
# stop-at-first-failure).
|
|
forbidden-patterns:
|
|
name: Forbidden patterns (7 checks)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Run all forbidden-pattern checks
|
|
run: |
|
|
FAIL=0
|
|
|
|
# ---------- (1) No dev endpoints in pages/api ----------
|
|
echo "::group::Check 1/6: No dev endpoints in pages/api"
|
|
BAD_PATHS=(
|
|
"pages/api/simple.js"
|
|
"pages/api/test-auth.js"
|
|
"pages/api/test-db.js"
|
|
"pages/api/setup-database.js"
|
|
)
|
|
FOUND=()
|
|
for path in "${BAD_PATHS[@]}"; do
|
|
if [ -f "$path" ]; then
|
|
FOUND+=("$path")
|
|
fi
|
|
done
|
|
while IFS= read -r path; do
|
|
FOUND+=("$path")
|
|
done < <(find pages/api -maxdepth 4 -type f -name 'test-*.js' 2>/dev/null || true)
|
|
if [ ${#FOUND[@]} -gt 0 ]; then
|
|
echo "::error::Forbidden dev endpoints present in pages/api/. Delete them or move to scripts/."
|
|
for path in "${FOUND[@]}"; do
|
|
echo "::error file=${path}::Forbidden dev endpoint."
|
|
done
|
|
FAIL=1
|
|
else
|
|
echo "OK: no forbidden dev endpoints under pages/api/."
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
# ---------- (2) No wildcard CORS in pages/api ----------
|
|
echo "::group::Check 2/6: No wildcard CORS in pages/api"
|
|
MATCHES=$(grep -rEn 'Access-Control-Allow-(Origin|Methods|Headers)' pages/api/ 2>/dev/null || true)
|
|
if [ -n "$MATCHES" ]; then
|
|
echo "::error::Forbidden CORS headers present under pages/api/. Remove them — same-origin Vercel deployment does not need CORS."
|
|
echo "$MATCHES" | while IFS= read -r line; do
|
|
file=$(echo "$line" | cut -d: -f1)
|
|
lineno=$(echo "$line" | cut -d: -f2)
|
|
echo "::error file=${file},line=${lineno}::Forbidden CORS header — delete this line."
|
|
done
|
|
FAIL=1
|
|
else
|
|
echo "OK: no Access-Control-Allow-* headers under pages/api/."
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
# ---------- (3) No client-side LLM key leakage ----------
|
|
echo "::group::Check 3/6: No client-side LLM key leakage"
|
|
if [ -f pages/api/config/gemini.js ]; then
|
|
echo "::error file=pages/api/config/gemini.js::Forbidden config endpoint — do not return API keys to browsers."
|
|
FAIL=1
|
|
fi
|
|
CONFIG_MATCHES=$(grep -rEn 'apiKey:' pages/api/config/ 2>/dev/null || true)
|
|
if [ -n "$CONFIG_MATCHES" ]; then
|
|
echo "::error::Forbidden apiKey response under pages/api/config/."
|
|
echo "$CONFIG_MATCHES" | while IFS= read -r line; do
|
|
file=$(echo "$line" | cut -d: -f1)
|
|
lineno=$(echo "$line" | cut -d: -f2)
|
|
echo "::error file=${file},line=${lineno}::Do not return API keys from config endpoints."
|
|
done
|
|
FAIL=1
|
|
fi
|
|
AI_OCR_IMPORTS=$(grep -rEn 'from ['\''"].*ai-ocr|import.*ai-ocr' components/ 2>/dev/null || true)
|
|
if [ -n "$AI_OCR_IMPORTS" ]; then
|
|
echo "::error::Browser code must not import lib/ai-ocr — use POST /api/scan/identify instead."
|
|
echo "$AI_OCR_IMPORTS" | while IFS= read -r line; do
|
|
file=$(echo "$line" | cut -d: -f1)
|
|
lineno=$(echo "$line" | cut -d: -f2)
|
|
echo "::error file=${file},line=${lineno}::Remove ai-ocr import; call server-side scan API."
|
|
done
|
|
FAIL=1
|
|
fi
|
|
SERVER_ONLY=(
|
|
lib/scan-vision.js
|
|
)
|
|
LLM_PATTERN='generativelanguage\.googleapis\.com|api\.openai\.com|ai-gateway\.vercel\.sh'
|
|
LLM_FOUND=()
|
|
while IFS= read -r file; do
|
|
skip=false
|
|
for so in "${SERVER_ONLY[@]}"; do
|
|
if [ "$file" = "$so" ]; then
|
|
skip=true
|
|
break
|
|
fi
|
|
done
|
|
if [ "$skip" = true ]; then
|
|
continue
|
|
fi
|
|
if grep -qE "$LLM_PATTERN" "$file" 2>/dev/null; then
|
|
LLM_FOUND+=("$file")
|
|
fi
|
|
done < <(find components lib pages -name '*.js' ! -path 'pages/api/*' 2>/dev/null || true)
|
|
if [ ${#LLM_FOUND[@]} -gt 0 ]; then
|
|
echo "::error::Client-side LLM API URLs must not appear outside pages/api/."
|
|
for path in "${LLM_FOUND[@]}"; do
|
|
echo "::error file=${path}::Move LLM calls server-side or add to server-side-scan-pipeline removal list."
|
|
done
|
|
FAIL=1
|
|
fi
|
|
[ ${#LLM_FOUND[@]} -eq 0 ] && [ -z "$CONFIG_MATCHES" ] && [ -z "$AI_OCR_IMPORTS" ] && [ ! -f pages/api/config/gemini.js ] && echo "OK: no client-side LLM key leakage patterns detected."
|
|
echo "::endgroup::"
|
|
|
|
# ---------- (4) No legacy modal shells ----------
|
|
echo "::group::Check 4/6: No new modal shells without <Modal> primitive"
|
|
MODAL_FOUND=()
|
|
while IFS= read -r file; do
|
|
MODAL_FOUND+=("$file")
|
|
done < <(grep -lE 'fixed inset-0 bg-black bg-opacity-' \
|
|
pages components -r --include='*.js' 2>/dev/null \
|
|
| sort -u || true)
|
|
if [ ${#MODAL_FOUND[@]} -gt 0 ]; then
|
|
echo "::error::Legacy modal-shell pattern detected. Use the <Modal> primitive from components/ui/."
|
|
for f in "${MODAL_FOUND[@]}"; do
|
|
echo "::error file=${f}::Replace 'fixed inset-0 bg-black bg-opacity-' with <Modal open={…} onClose={…} title=…> from components/ui."
|
|
done
|
|
FAIL=1
|
|
else
|
|
echo "OK: no legacy modal shells anywhere in pages/ or components/."
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
# ---------- (5) No deprecated color aliases ----------
|
|
echo "::group::Check 5/6: No use of deprecated color aliases"
|
|
PATTERNS=(
|
|
'gradient-text-purple'
|
|
'gradient-text-pink'
|
|
'gradient-text-blue'
|
|
'glow-purple'
|
|
'glow-pink'
|
|
'glow-blue'
|
|
'gradient-bg-purple'
|
|
'gradient-bg-blue'
|
|
'gradient-bg-pink'
|
|
)
|
|
ALL_MATCHES=""
|
|
for pattern in "${PATTERNS[@]}"; do
|
|
P_MATCHES=$(grep -rFn "$pattern" pages components --include='*.js' 2>/dev/null || true)
|
|
if [ -n "$P_MATCHES" ]; then
|
|
ALL_MATCHES=$(printf '%s\n%s' "$ALL_MATCHES" "$P_MATCHES")
|
|
fi
|
|
done
|
|
if [ -n "$ALL_MATCHES" ]; then
|
|
echo "::error::Deprecated color alias detected. Use --accent-ember / --accent-flame / --accent-gold (or the .gradient-bg-ember / .gradient-text-ember utility classes)."
|
|
echo "$ALL_MATCHES" | sort -u | while IFS= read -r line; do
|
|
[ -z "$line" ] && continue
|
|
file=$(echo "$line" | cut -d: -f1)
|
|
lineno=$(echo "$line" | cut -d: -f2)
|
|
echo "::error file=${file},line=${lineno}::Deprecated color alias — replace with the canonical Deck Hearth warm-palette equivalent."
|
|
done
|
|
FAIL=1
|
|
else
|
|
echo "OK: no deprecated color aliases in pages/ or components/."
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
# ---------- (6) No stale ownership/collection copy ----------
|
|
echo "::group::Check 6/6: No stale ownership/collection copy"
|
|
STRING_PATTERNS=(
|
|
'Mark Owned'
|
|
'Owned Cards'
|
|
'All My Cards'
|
|
)
|
|
STRING_FOUND=()
|
|
for pattern in "${STRING_PATTERNS[@]}"; do
|
|
while IFS= read -r line; do
|
|
STRING_FOUND+=("$line")
|
|
done < <(grep -rFn "$pattern" pages/ components/ \
|
|
--include='*.js' \
|
|
--exclude-dir=api 2>/dev/null || true)
|
|
done
|
|
if [ ${#STRING_FOUND[@]} -gt 0 ]; then
|
|
echo "::error::Forbidden stale UI string(s) in pages/ or components/. Use lib/collection-vocabulary.js labels — see AGENTS.md § Product vocabulary."
|
|
printf '%s\n' "${STRING_FOUND[@]}" | sort -u | while IFS= read -r line; do
|
|
file=$(echo "$line" | cut -d: -f1)
|
|
lineno=$(echo "$line" | cut -d: -f2)
|
|
text=$(echo "$line" | cut -d: -f3-)
|
|
echo "::error file=${file},line=${lineno}::${text}"
|
|
done
|
|
FAIL=1
|
|
else
|
|
echo "OK: no forbidden stale strings in pages/ or components/."
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
# ---------- (7) No bespoke var(--glass-surface-*) inline styles ----------
|
|
echo "::group::Check 7/7: No bespoke var(--glass-surface-*) inline styles"
|
|
# unify-glass-panel-surfaces convoy, Brief 7 (PR sequence after #126).
|
|
# After Briefs 1-6 land, every panel-shaped surface in the app
|
|
# composes via .glass-panel / .glass-panel-strong /
|
|
# .page-header-glass / <GlassSurface>. Bespoke inline-style use
|
|
# of var(--glass-surface-low|mid|high) under pages/ or
|
|
# components/ JSX is the regression vector this gate prevents.
|
|
#
|
|
# Allowlist (explicit, documented exceptions):
|
|
# --- Chrome blocks (D4 of architect plan, ratified) ---
|
|
# - components/ui/GlassSurface.js # the primitive itself
|
|
# - components/Layout.js # sidebar nav-chip chrome (L850 area)
|
|
# - components/ui/TopSearchBar.js # <header> chrome
|
|
# --- Pending migrations (queued follow-up convoy) ---
|
|
# TODO: migrate-button-input-mobilenav-to-glass-primitive convoy.
|
|
# The 3 entries below currently handroll their own glass
|
|
# surfaces — they should compose <GlassSurface> (cornerLights
|
|
# default 'subtle' from Brief 1) or the appropriate
|
|
# .glass-panel-* class. They are allowlisted so this gate can
|
|
# ship NOW and prevent future regressions; the cleanup is
|
|
# tracked in `.convoys/migrate-button-input-mobilenav-to-glass-primitive.md`.
|
|
# When that convoy lands, remove the 3 entries below.
|
|
# - components/ui/Button.js # secondary variant inline + hover:bg-[var(...)]
|
|
# - components/ui/Input.js # input fill background
|
|
# - components/MobileNavigation.js # bottom-nav background
|
|
#
|
|
# Adding a fourth chrome-tier entry is a design-system decision
|
|
# — open a new convoy. Removing an entry from the pending-
|
|
# migration tier requires the matching convoy to ship.
|
|
GLASS_ALLOWLIST=(
|
|
"components/ui/GlassSurface.js"
|
|
"components/Layout.js"
|
|
"components/ui/TopSearchBar.js"
|
|
"components/ui/Button.js"
|
|
"components/ui/Input.js"
|
|
"components/MobileNavigation.js"
|
|
)
|
|
GLASS_FOUND=()
|
|
while IFS= read -r file; do
|
|
skip=false
|
|
for allowed in "${GLASS_ALLOWLIST[@]}"; do
|
|
if [ "$file" = "$allowed" ]; then
|
|
skip=true
|
|
break
|
|
fi
|
|
done
|
|
if [ "$skip" = true ]; then
|
|
continue
|
|
fi
|
|
GLASS_FOUND+=("$file")
|
|
done < <(grep -lE "var\\(--glass-surface-(low|mid|high)\\)" \
|
|
pages components -r --include='*.js' 2>/dev/null \
|
|
| sort -u || true)
|
|
if [ ${#GLASS_FOUND[@]} -gt 0 ]; then
|
|
echo "::error::Bespoke var(--glass-surface-*) inline styles detected outside the documented allowlist."
|
|
echo "Use .glass-panel / .glass-panel-strong / .page-header-glass or compose <GlassSurface> from components/ui/ instead."
|
|
for f in "${GLASS_FOUND[@]}"; do
|
|
echo "::error file=${f}::Replace inline var(--glass-surface-*) with the appropriate class or primitive."
|
|
done
|
|
FAIL=1
|
|
else
|
|
echo "OK: no bespoke glass-surface inline styles outside the allowlist."
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
# ---------- Final exit ----------
|
|
if [ "$FAIL" -ne 0 ]; then
|
|
echo "::error::One or more forbidden-pattern checks failed. See annotations above."
|
|
exit 1
|
|
fi
|
|
echo "All 7 forbidden-pattern checks passed."
|
|
|
|
migrate:
|
|
name: Migrations apply (node-pg-migrate)
|
|
runs-on: ubuntu-latest
|
|
services:
|
|
postgres:
|
|
image: postgres:16
|
|
env:
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: postgres
|
|
POSTGRES_DB: deckhearth_test
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd pg_isready
|
|
--health-interval 10s
|
|
--health-timeout 5s
|
|
--health-retries 5
|
|
env:
|
|
POSTGRES_URL: postgres://postgres:postgres@localhost:5432/deckhearth_test
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
cache: npm
|
|
- name: Cache node_modules
|
|
id: cache-node-modules
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: node_modules
|
|
key: node-modules-${{ runner.os }}-node${{ env.NODE_VERSION }}-${{ hashFiles('package-lock.json') }}
|
|
- run: npm ci
|
|
if: steps.cache-node-modules.outputs.cache-hit != 'true'
|
|
- name: Write migrate env file
|
|
run: echo "POSTGRES_URL=${POSTGRES_URL}" >> .env.local
|
|
- run: npm run migrate up
|
|
|
|
test:
|
|
name: Unit tests (vitest)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
cache: npm
|
|
- name: Cache node_modules
|
|
id: cache-node-modules
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: node_modules
|
|
key: node-modules-${{ runner.os }}-node${{ env.NODE_VERSION }}-${{ hashFiles('package-lock.json') }}
|
|
- run: npm ci
|
|
if: steps.cache-node-modules.outputs.cache-hit != 'true'
|
|
- run: npm run test:run
|
|
env:
|
|
JWT_SECRET: ci-secret-only-for-tests-do-not-use-in-prod
|