From cc3c44ca4cd230a3590a599ccfae4dbff2c03780 Mon Sep 17 00:00:00 2001 From: ZxlDragonDoctor <152901610+ZxlDragonDoctor@users.noreply.github.com> Date: Fri, 11 Sep 2026 20:04:52 +0800 Subject: [PATCH 1/4] docs(vercel): document Node.js runtime source of truth --- docs/vercel-deployment.md | 179 ++++++++++++++++++++++---------------- 1 file changed, 104 insertions(+), 75 deletions(-) diff --git a/docs/vercel-deployment.md b/docs/vercel-deployment.md index 10fdf3e..cc88c4e 100644 --- a/docs/vercel-deployment.md +++ b/docs/vercel-deployment.md @@ -1,75 +1,104 @@ -# Vercel Deployment - -Fulling's public application can be deployed to Vercel without configuring -GitHub OAuth, Better Auth, or PostgreSQL. Those integrations are currently -optional so they do not block preview and production builds while workspace -access is being rebuilt. - -## Project settings - -Connect `FullAgent/fulling` to a Vercel project and keep these settings: - -- Framework preset: Next.js -- Root directory: repository root -- Install command: Vercel default (`npm install` from `package-lock.json`) -- Build command: `npm run build` -- Output directory: Vercel default -- Node.js: 24.x, enforced by `package.json` -- Production branch: `main` - -No `vercel.json` file or application environment variables are required for this -deployment mode. Do not set `SKIP_ENV_VALIDATION`; absent optional integrations -are handled by the application itself. - -`output: 'standalone'` remains enabled because the Docker image consumes it. -Vercel uses its native Next.js output. - -## Zero-configuration behavior - -Without the legacy Auth and database variables: - -- `/` renders the public landing page. -- `/login` renders an explicit sign-in unavailable state. -- `/api/auth/*` returns `503 AUTH_UNAVAILABLE` instead of initializing Better - Auth with an unsafe default secret. -- Protected workspace routes redirect to `/login`. -- No Prisma query or Kubernetes credential operation is attempted for anonymous - requests. - -The legacy Auth path is enabled only when all five variables are present: - -- `DATABASE_URL` -- `BETTER_AUTH_URL` -- `BETTER_AUTH_SECRET` -- `GITHUB_CLIENT_ID` -- `GITHUB_CLIENT_SECRET` - -This compatibility path is not required for the current Vercel deployment and -will be replaced with the next authentication design. - -## Deploy and verify - -With Git integration, push a feature branch to create a Preview deployment and -merge the verified commit to `main` for Production. - -Verify the zero-configuration deployment: - -1. Confirm `/` returns a successful response and renders the landing page. -2. Confirm `/login` returns a successful response and shows the unavailable - state without a Better Auth error. -3. Confirm a request to `/api/auth/session` returns a structured 503 response. -4. Inspect the build and Function logs and confirm there are no missing-secret, - Prisma connection, or Kubernetes connection errors. - -Inspect a deployment in the Vercel dashboard or with the CLI: - -```bash -vercel inspect -vercel logs -``` - -Roll back a bad production deployment with: - -```bash -vercel rollback -``` +# Vercel Deployment + +Fulling's public application can be deployed to Vercel without configuring +GitHub OAuth, Better Auth, or PostgreSQL. Those integrations are currently +optional so they do not block preview and production builds while workspace +access is being rebuilt. + +## Project settings + +Connect `FullAgent/fulling` to a Vercel project and keep these settings: + +- Framework preset: Next.js +- Root directory: repository root +- Install command: Vercel default (`npm install` from `package-lock.json`) +- Build command: `npm run build` +- Output directory: Vercel default +- Node.js: 24.x (Project Settings), matching `package.json#engines.node` +- Production branch: `main` + +No `vercel.json` file or application environment variables are required for this +deployment mode. Do not set `SKIP_ENV_VALIDATION`; absent optional integrations +are handled by the application itself. + +`output: 'standalone'` remains enabled because the Docker image consumes it. +Vercel uses its native Next.js output. + +## Node.js runtime source of truth + +`package.json#engines.node` is the repository-owned source of truth for the +Node.js major used by Vercel builds and Functions. Vercel documents that +`engines.node` overrides the project dashboard selection, so a dashboard value +that disagrees with the repository produces a version override warning even when +the deployment succeeds. + +Keep these locations on the same major (currently **24**): + +| Location | Role | +| -------- | ---- | +| `package.json#engines.node` | Authoritative for Vercel and local installs | +| `package-lock.json` root `engines` | Must match `package.json` after `npm install` | +| `.github/workflows/ci.yml` `NODE_VERSION` | CI and release verification pin | +| `Dockerfile` `FROM node:-alpine` | Container build/runtime image | +| Vercel Project Settings → Node.js Version | Dashboard mirror of the same major | +| This document | Operator guidance | + +When changing the Node.js major, update every row in one pull request and verify +a clean Preview deploy (and Docker build) before merge. Do not add a separate +`.nvmrc` or `.node-version` unless the team deliberately changes this policy. + +To silence an override warning without a code change: set Vercel Project +Settings → Node.js Version to the same major as `package.json` (currently `24.x`). +A dashboard default that still points at a different major (for example Node.js +22 or 24 while the repository declares another) will keep warning until both +sides match. + +## Zero-configuration behavior + +Without the legacy Auth and database variables: + +- `/` renders the public landing page. +- `/login` renders an explicit sign-in unavailable state. +- `/api/auth/*` returns `503 AUTH_UNAVAILABLE` instead of initializing Better + Auth with an unsafe default secret. +- Protected workspace routes redirect to `/login`. +- No Prisma query or Kubernetes credential operation is attempted for anonymous + requests. + +The legacy Auth path is enabled only when all five variables are present: + +- `DATABASE_URL` +- `BETTER_AUTH_URL` +- `BETTER_AUTH_SECRET` +- `GITHUB_CLIENT_ID` +- `GITHUB_CLIENT_SECRET` + +This compatibility path is not required for the current Vercel deployment and +will be replaced with the next authentication design. + +## Deploy and verify + +With Git integration, push a feature branch to create a Preview deployment and +merge the verified commit to `main` for Production. + +Verify the zero-configuration deployment: + +1. Confirm `/` returns a successful response and renders the landing page. +2. Confirm `/login` returns a successful response and shows the unavailable + state without a Better Auth error. +3. Confirm a request to `/api/auth/session` returns a structured 503 response. +4. Inspect the build and Function logs and confirm there are no missing-secret, + Prisma connection, or Kubernetes connection errors. + +Inspect a deployment in the Vercel dashboard or with the CLI: + +```bash +vercel inspect +vercel logs +``` + +Roll back a bad production deployment with: + +```bash +vercel rollback +``` From bf2c00d7e481edfa9b814ebeb7b29ae5fefdf16e Mon Sep 17 00:00:00 2001 From: ZxlDragonDoctor <152901610+ZxlDragonDoctor@users.noreply.github.com> Date: Fri, 11 Sep 2026 20:04:54 +0800 Subject: [PATCH 2/4] docs(vercel): document Node.js runtime source of truth --- docs/dependency-maintenance.md | 140 +++++++++++++++++---------------- 1 file changed, 71 insertions(+), 69 deletions(-) diff --git a/docs/dependency-maintenance.md b/docs/dependency-maintenance.md index c186340..5d35829 100644 --- a/docs/dependency-maintenance.md +++ b/docs/dependency-maintenance.md @@ -1,69 +1,71 @@ -# Dependency Maintenance - -Fulling uses Dependabot to surface npm and GitHub Actions updates. Dependabot -opens reviewable pull requests; it must not auto-merge dependency changes. - -## Cadence - -- Apply security updates as soon as validation is complete. -- Review grouped patch and minor updates every week. -- Review major updates quarterly and migrate them separately. -- Coordinate Node.js changes across `package.json`, CI, Docker, Vercel, and - contributor documentation instead of allowing a single-file runtime bump. - -## Update boundaries - -- Keep one coherent dependency batch per commit. A pull request may contain - multiple independently reviewable batch commits. -- Update coupled packages together, including Next.js with - `eslint-config-next`, React with React DOM, Prisma with `@prisma/client` and - its driver adapter, and Tailwind CSS with `@tailwindcss/postcss`. -- Keep major migrations separate from unrelated dependency changes. -- Never use `npm audit fix --force` as a substitute for compatibility review. - -## Lockfile review - -- Change dependency requirements in `package.json` and regenerate - `package-lock.json` with npm; never edit the lockfile by hand. -- Use `npm ci` to verify that a clean checkout installs reproducibly. -- Confirm that lockfile churn is attributable to the intended dependency - batch and review new lifecycle scripts, native binaries, and overrides. -- Commit `package.json` and `package-lock.json` together. - -## Required validation - -Run both production-only and complete vulnerability reviews: - -```bash -npm run audit:prod -npm run audit -``` - -Every dependency batch must also pass the checks relevant to its scope: - -```bash -npm ci -npm run lint -npm test -npm run prisma:validate -npm run prisma:migrate -npm run test:e2e -npm run build -``` - -Runtime, database, framework, or deployment changes also require a Docker image -build, startup smoke test, and the relevant authentication, PostgreSQL, and -user-specific Kubernetes checks. - -## Dependabot policy - -- Patch and minor npm updates are grouped by framework, data/auth, frontend, - test/quality, and remaining dependencies. -- Major updates remain individual review items. TypeScript 7, ESLint 10, and - `eslint-plugin-simple-import-sort` 13 are explicitly deferred until their - ecosystem compatibility is reviewed. -- GitHub Actions updates are grouped separately. -- Docker updates are intentionally excluded so the Node.js baseline cannot - drift away from CI, package engines, Vercel, and documentation. -- Dependabot alerts and security updates must be enabled in the repository's - GitHub security settings after this configuration reaches the default branch. +# Dependency Maintenance + +Fulling uses Dependabot to surface npm and GitHub Actions updates. Dependabot +opens reviewable pull requests; it must not auto-merge dependency changes. + +## Cadence + +- Apply security updates as soon as validation is complete. +- Review grouped patch and minor updates every week. +- Review major updates quarterly and migrate them separately. +- Coordinate Node.js changes across `package.json`, CI, Docker, Vercel, and + contributor documentation instead of allowing a single-file runtime bump. + `package.json#engines.node` is the source of truth; see + [Vercel Node.js runtime source of truth](./vercel-deployment.md#nodejs-runtime-source-of-truth). + +## Update boundaries + +- Keep one coherent dependency batch per commit. A pull request may contain + multiple independently reviewable batch commits. +- Update coupled packages together, including Next.js with + `eslint-config-next`, React with React DOM, Prisma with `@prisma/client` and + its driver adapter, and Tailwind CSS with `@tailwindcss/postcss`. +- Keep major migrations separate from unrelated dependency changes. +- Never use `npm audit fix --force` as a substitute for compatibility review. + +## Lockfile review + +- Change dependency requirements in `package.json` and regenerate + `package-lock.json` with npm; never edit the lockfile by hand. +- Use `npm ci` to verify that a clean checkout installs reproducibly. +- Confirm that lockfile churn is attributable to the intended dependency + batch and review new lifecycle scripts, native binaries, and overrides. +- Commit `package.json` and `package-lock.json` together. + +## Required validation + +Run both production-only and complete vulnerability reviews: + +```bash +npm run audit:prod +npm run audit +``` + +Every dependency batch must also pass the checks relevant to its scope: + +```bash +npm ci +npm run lint +npm test +npm run prisma:validate +npm run prisma:migrate +npm run test:e2e +npm run build +``` + +Runtime, database, framework, or deployment changes also require a Docker image +build, startup smoke test, and the relevant authentication, PostgreSQL, and +user-specific Kubernetes checks. + +## Dependabot policy + +- Patch and minor npm updates are grouped by framework, data/auth, frontend, + test/quality, and remaining dependencies. +- Major updates remain individual review items. TypeScript 7, ESLint 10, and + `eslint-plugin-simple-import-sort` 13 are explicitly deferred until their + ecosystem compatibility is reviewed. +- GitHub Actions updates are grouped separately. +- Docker updates are intentionally excluded so the Node.js baseline cannot + drift away from CI, package engines, Vercel, and documentation. +- Dependabot alerts and security updates must be enabled in the repository's + GitHub security settings after this configuration reaches the default branch. From a4d73a76b5a26a2eeb822eca148bb23a9d9fcbfc Mon Sep 17 00:00:00 2001 From: ZxlDragonDoctor <152901610+ZxlDragonDoctor@users.noreply.github.com> Date: Fri, 11 Sep 2026 20:11:33 +0800 Subject: [PATCH 3/4] docs(vercel): document Node.js runtime source of truth --- docs/vercel-deployment.md | 208 +++++++++++++++++++------------------- 1 file changed, 104 insertions(+), 104 deletions(-) diff --git a/docs/vercel-deployment.md b/docs/vercel-deployment.md index cc88c4e..cd3fc33 100644 --- a/docs/vercel-deployment.md +++ b/docs/vercel-deployment.md @@ -1,104 +1,104 @@ -# Vercel Deployment - -Fulling's public application can be deployed to Vercel without configuring -GitHub OAuth, Better Auth, or PostgreSQL. Those integrations are currently -optional so they do not block preview and production builds while workspace -access is being rebuilt. - -## Project settings - -Connect `FullAgent/fulling` to a Vercel project and keep these settings: - -- Framework preset: Next.js -- Root directory: repository root -- Install command: Vercel default (`npm install` from `package-lock.json`) -- Build command: `npm run build` -- Output directory: Vercel default -- Node.js: 24.x (Project Settings), matching `package.json#engines.node` -- Production branch: `main` - -No `vercel.json` file or application environment variables are required for this -deployment mode. Do not set `SKIP_ENV_VALIDATION`; absent optional integrations -are handled by the application itself. - -`output: 'standalone'` remains enabled because the Docker image consumes it. -Vercel uses its native Next.js output. - -## Node.js runtime source of truth - -`package.json#engines.node` is the repository-owned source of truth for the -Node.js major used by Vercel builds and Functions. Vercel documents that -`engines.node` overrides the project dashboard selection, so a dashboard value -that disagrees with the repository produces a version override warning even when -the deployment succeeds. - -Keep these locations on the same major (currently **24**): - -| Location | Role | -| -------- | ---- | -| `package.json#engines.node` | Authoritative for Vercel and local installs | -| `package-lock.json` root `engines` | Must match `package.json` after `npm install` | -| `.github/workflows/ci.yml` `NODE_VERSION` | CI and release verification pin | -| `Dockerfile` `FROM node:-alpine` | Container build/runtime image | -| Vercel Project Settings → Node.js Version | Dashboard mirror of the same major | -| This document | Operator guidance | - -When changing the Node.js major, update every row in one pull request and verify -a clean Preview deploy (and Docker build) before merge. Do not add a separate -`.nvmrc` or `.node-version` unless the team deliberately changes this policy. - -To silence an override warning without a code change: set Vercel Project -Settings → Node.js Version to the same major as `package.json` (currently `24.x`). -A dashboard default that still points at a different major (for example Node.js -22 or 24 while the repository declares another) will keep warning until both -sides match. - -## Zero-configuration behavior - -Without the legacy Auth and database variables: - -- `/` renders the public landing page. -- `/login` renders an explicit sign-in unavailable state. -- `/api/auth/*` returns `503 AUTH_UNAVAILABLE` instead of initializing Better - Auth with an unsafe default secret. -- Protected workspace routes redirect to `/login`. -- No Prisma query or Kubernetes credential operation is attempted for anonymous - requests. - -The legacy Auth path is enabled only when all five variables are present: - -- `DATABASE_URL` -- `BETTER_AUTH_URL` -- `BETTER_AUTH_SECRET` -- `GITHUB_CLIENT_ID` -- `GITHUB_CLIENT_SECRET` - -This compatibility path is not required for the current Vercel deployment and -will be replaced with the next authentication design. - -## Deploy and verify - -With Git integration, push a feature branch to create a Preview deployment and -merge the verified commit to `main` for Production. - -Verify the zero-configuration deployment: - -1. Confirm `/` returns a successful response and renders the landing page. -2. Confirm `/login` returns a successful response and shows the unavailable - state without a Better Auth error. -3. Confirm a request to `/api/auth/session` returns a structured 503 response. -4. Inspect the build and Function logs and confirm there are no missing-secret, - Prisma connection, or Kubernetes connection errors. - -Inspect a deployment in the Vercel dashboard or with the CLI: - -```bash -vercel inspect -vercel logs -``` - -Roll back a bad production deployment with: - -```bash -vercel rollback -``` +# Vercel Deployment + +Fulling's public application can be deployed to Vercel without configuring +GitHub OAuth, Better Auth, or PostgreSQL. Those integrations are currently +optional so they do not block preview and production builds while workspace +access is being rebuilt. + +## Project settings + +Connect `FullAgent/fulling` to a Vercel project and keep these settings: + +- Framework preset: Next.js +- Root directory: repository root +- Install command: Vercel default (`npm install` from `package-lock.json`) +- Build command: `npm run build` +- Output directory: Vercel default +- Node.js: 24.x (Project Settings), matching `package.json#engines.node` +- Production branch: `main` + +No `vercel.json` file or application environment variables are required for this +deployment mode. Do not set `SKIP_ENV_VALIDATION`; absent optional integrations +are handled by the application itself. + +`output: 'standalone'` remains enabled because the Docker image consumes it. +Vercel uses its native Next.js output. + +## Node.js runtime source of truth + +`package.json#engines.node` is the repository-owned source of truth for the +Node.js major used by Vercel builds and Functions. Vercel documents that +`engines.node` overrides the project dashboard selection, so a dashboard value +that disagrees with the repository produces a version override warning even when +the deployment succeeds. + +Keep these locations on the same major (currently **24**): + +| Location | Role | +| -------- | ---- | +| `package.json#engines.node` | Authoritative for Vercel and local installs | +| `package-lock.json` root `engines` | Must match `package.json` after `npm install` | +| `.github/workflows/ci.yml` `NODE_VERSION` | CI and release verification pin | +| `Dockerfile` `FROM node:-alpine` | Container build/runtime image | +| Vercel Project Settings → Node.js Version | Dashboard mirror of the same major | +| This document | Operator guidance | + +When changing the Node.js major, update every row in one pull request and verify +a clean Preview deploy (and Docker build) before merge. Do not add a separate +`.nvmrc` or `.node-version` unless the team deliberately changes this policy. + +To silence an override warning without a code change: set Vercel Project +Settings → Node.js Version to the same major as `package.json` (currently `24.x`). +A dashboard default that still points at a different major (for example Node.js +22 or 24 while the repository declares another) will keep warning until both +sides match. + +## Zero-configuration behavior + +Without the legacy Auth and database variables: + +- `/` renders the public landing page. +- `/login` renders an explicit sign-in unavailable state. +- `/api/auth/*` returns `503 AUTH_UNAVAILABLE` instead of initializing Better + Auth with an unsafe default secret. +- Protected workspace routes redirect to `/login`. +- No Prisma query or Kubernetes credential operation is attempted for anonymous + requests. + +The legacy Auth path is enabled only when all five variables are present: + +- `DATABASE_URL` +- `BETTER_AUTH_URL` +- `BETTER_AUTH_SECRET` +- `GITHUB_CLIENT_ID` +- `GITHUB_CLIENT_SECRET` + +This compatibility path is not required for the current Vercel deployment and +will be replaced with the next authentication design. + +## Deploy and verify + +With Git integration, push a feature branch to create a Preview deployment and +merge the verified commit to `main` for Production. + +Verify the zero-configuration deployment: + +1. Confirm `/` returns a successful response and renders the landing page. +2. Confirm `/login` returns a successful response and shows the unavailable + state without a Better Auth error. +3. Confirm a request to `/api/auth/session` returns a structured 503 response. +4. Inspect the build and Function logs and confirm there are no missing-secret, + Prisma connection, or Kubernetes connection errors. + +Inspect a deployment in the Vercel dashboard or with the CLI: + +```bash +vercel inspect +vercel logs +``` + +Roll back a bad production deployment with: + +```bash +vercel rollback +``` From 22ac551122155a225ae9b56b7180c43bd65c16f2 Mon Sep 17 00:00:00 2001 From: ZxlDragonDoctor <152901610+ZxlDragonDoctor@users.noreply.github.com> Date: Fri, 11 Sep 2026 20:11:34 +0800 Subject: [PATCH 4/4] docs(vercel): link Node source of truth from dependency policy --- docs/dependency-maintenance.md | 142 ++++++++++++++++----------------- 1 file changed, 71 insertions(+), 71 deletions(-) diff --git a/docs/dependency-maintenance.md b/docs/dependency-maintenance.md index 5d35829..d37c7e7 100644 --- a/docs/dependency-maintenance.md +++ b/docs/dependency-maintenance.md @@ -1,71 +1,71 @@ -# Dependency Maintenance - -Fulling uses Dependabot to surface npm and GitHub Actions updates. Dependabot -opens reviewable pull requests; it must not auto-merge dependency changes. - -## Cadence - -- Apply security updates as soon as validation is complete. -- Review grouped patch and minor updates every week. -- Review major updates quarterly and migrate them separately. -- Coordinate Node.js changes across `package.json`, CI, Docker, Vercel, and - contributor documentation instead of allowing a single-file runtime bump. - `package.json#engines.node` is the source of truth; see - [Vercel Node.js runtime source of truth](./vercel-deployment.md#nodejs-runtime-source-of-truth). - -## Update boundaries - -- Keep one coherent dependency batch per commit. A pull request may contain - multiple independently reviewable batch commits. -- Update coupled packages together, including Next.js with - `eslint-config-next`, React with React DOM, Prisma with `@prisma/client` and - its driver adapter, and Tailwind CSS with `@tailwindcss/postcss`. -- Keep major migrations separate from unrelated dependency changes. -- Never use `npm audit fix --force` as a substitute for compatibility review. - -## Lockfile review - -- Change dependency requirements in `package.json` and regenerate - `package-lock.json` with npm; never edit the lockfile by hand. -- Use `npm ci` to verify that a clean checkout installs reproducibly. -- Confirm that lockfile churn is attributable to the intended dependency - batch and review new lifecycle scripts, native binaries, and overrides. -- Commit `package.json` and `package-lock.json` together. - -## Required validation - -Run both production-only and complete vulnerability reviews: - -```bash -npm run audit:prod -npm run audit -``` - -Every dependency batch must also pass the checks relevant to its scope: - -```bash -npm ci -npm run lint -npm test -npm run prisma:validate -npm run prisma:migrate -npm run test:e2e -npm run build -``` - -Runtime, database, framework, or deployment changes also require a Docker image -build, startup smoke test, and the relevant authentication, PostgreSQL, and -user-specific Kubernetes checks. - -## Dependabot policy - -- Patch and minor npm updates are grouped by framework, data/auth, frontend, - test/quality, and remaining dependencies. -- Major updates remain individual review items. TypeScript 7, ESLint 10, and - `eslint-plugin-simple-import-sort` 13 are explicitly deferred until their - ecosystem compatibility is reviewed. -- GitHub Actions updates are grouped separately. -- Docker updates are intentionally excluded so the Node.js baseline cannot - drift away from CI, package engines, Vercel, and documentation. -- Dependabot alerts and security updates must be enabled in the repository's - GitHub security settings after this configuration reaches the default branch. +# Dependency Maintenance + +Fulling uses Dependabot to surface npm and GitHub Actions updates. Dependabot +opens reviewable pull requests; it must not auto-merge dependency changes. + +## Cadence + +- Apply security updates as soon as validation is complete. +- Review grouped patch and minor updates every week. +- Review major updates quarterly and migrate them separately. +- Coordinate Node.js changes across `package.json`, CI, Docker, Vercel, and + contributor documentation instead of allowing a single-file runtime bump. + `package.json#engines.node` is the source of truth; see + [Vercel Node.js runtime source of truth](./vercel-deployment.md#nodejs-runtime-source-of-truth). + +## Update boundaries + +- Keep one coherent dependency batch per commit. A pull request may contain + multiple independently reviewable batch commits. +- Update coupled packages together, including Next.js with + `eslint-config-next`, React with React DOM, Prisma with `@prisma/client` and + its driver adapter, and Tailwind CSS with `@tailwindcss/postcss`. +- Keep major migrations separate from unrelated dependency changes. +- Never use `npm audit fix --force` as a substitute for compatibility review. + +## Lockfile review + +- Change dependency requirements in `package.json` and regenerate + `package-lock.json` with npm; never edit the lockfile by hand. +- Use `npm ci` to verify that a clean checkout installs reproducibly. +- Confirm that lockfile churn is attributable to the intended dependency + batch and review new lifecycle scripts, native binaries, and overrides. +- Commit `package.json` and `package-lock.json` together. + +## Required validation + +Run both production-only and complete vulnerability reviews: + +```bash +npm run audit:prod +npm run audit +``` + +Every dependency batch must also pass the checks relevant to its scope: + +```bash +npm ci +npm run lint +npm test +npm run prisma:validate +npm run prisma:migrate +npm run test:e2e +npm run build +``` + +Runtime, database, framework, or deployment changes also require a Docker image +build, startup smoke test, and the relevant authentication, PostgreSQL, and +user-specific Kubernetes checks. + +## Dependabot policy + +- Patch and minor npm updates are grouped by framework, data/auth, frontend, + test/quality, and remaining dependencies. +- Major updates remain individual review items. TypeScript 7, ESLint 10, and + `eslint-plugin-simple-import-sort` 13 are explicitly deferred until their + ecosystem compatibility is reviewed. +- GitHub Actions updates are grouped separately. +- Docker updates are intentionally excluded so the Node.js baseline cannot + drift away from CI, package engines, Vercel, and documentation. +- Dependabot alerts and security updates must be enabled in the repository's + GitHub security settings after this configuration reaches the default branch.