Testing & release checks

Deterministic suites

pnpm format:check
pnpm lint
pnpm typecheck
pnpm test
pnpm test:e2e
pnpm build

Backend tests use real PostgreSQL/Prisma with mocked external identity, storage, push and delivery boundaries. Web/native tests verify UI and SDK adapters. Browser tests use isolated HTTPS servers and fake Clerk responses, not personal accounts. Never run suites against the development database.

Covered workflows

• Email signup/verification, Google redirects, callback errors and missing-profile completion.
• Console company/logo requirements; project wizard, callback validation, optional legal fields, upload failure and organization isolation.
• No-project sidebar state, creation and switching projects; secret reveal/hide.
• OIDC code exchange, PKCE, nonce, cookie/CSRF binding, expiry and replay.
• MCP handshake, legal acceptance/rejection/version changes, onboarding replies, blacklist and revocation.
• Exact-200 webhook retries, signing, stable IDs, worker leases and terminal failure.
• Mobile email auth, approvals, blacklist, deep links, foreground refresh and failed/unregistered push handling.

This is regression coverage, not proof of every possible input or device. See the repository's ONBOARDING-TEST-AUDIT.md for coverage and remaining checks.

Opt-in live integrations

NODE_ENV=test pnpm test:s3 --apply
pnpm test:auth0:install-tunnel
pnpm test:auth0

The S3 smoke writes only isolated fixtures to the approved development bucket. The Auth0 smoke creates a temporary application/connection/synthetic user in the approved dev tenant and performs a real broker exchange. Both clean up their own resources on ordinary exit. Forced termination needs manual fixture review.

Auth0 uses a free, temporary Cloudflare Quick Tunnel around an allowlisted disposable protocol gateway. It excludes tRPC, MCP, uploads, helpers and SSE; Quick Tunnels have no SLA or SSE support. Cloudflare limitations

The GitHub auth0-live environment and workflow are main-only/manual-only. The client ID is a variable; only its secret is a secret. Its create/delete clients, create/delete connections and read/delete users permissions are tenant-wide, so never reuse it in production or expose it to PR code. No token/trace artifacts.

Still separate release gates

Complete Google consent with an authorized test account; validate real native push credentials/build/device delivery; certify any downstream Auth0 claim Action; run the workflows remotely; and verify production DNS, deployment, monitoring, retention procedures and current legal approval. Local mocks do not certify these.