fix(ci): improve tutorial verification reliability

.github/workflows/quality.yml

@@ -19,35 +19,44 @@ concurrency:
 jobs:
   step:
     name: Tutorial helper (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
+    needs: changes
+    if: needs.changes.outputs.helper == 'true'
+    runs-on: ${{ matrix.os == 'ubuntu-latest' && 'ubuntu-24.04' || matrix.os }}
     timeout-minutes: 5
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v7.0.1
-      - uses: actions/setup-node@v7.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24.21.0
       - name: Check tutorial step helper
-        run: node --test shared/tools/step/run.test.mjs
+        id: check
+        run: node --test shared/tools/step/run.test.mjs shared/tools/step/source.test.mjs
 
   changes:
     name: Select projects
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
     outputs:
       projects: ${{ steps.select.outputs.projects }}
       compose: ${{ steps.select.outputs.compose }}
+      helper: ${{ steps.select.outputs.helper }}
+      concurrent: ${{ steps.select.outputs.concurrent }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: pnpm/action-setup@v6.1.0
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           version: 10.17.1
           run_install: false
-      - uses: actions/setup-node@v7.1.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24.21.0
           cache: pnpm
@@ -58,6 +67,10 @@ jobs:
       - name: Check repository automation
         working-directory: shared/tools/repository-automation
         run: pnpm check
+      - name: Audit repository automation
+        timeout-minutes: 2
+        working-directory: shared/tools/repository-automation
+        run: pnpm audit --audit-level low
       - id: select
         name: Detect affected projects
         run: node shared/tools/repository-automation/changed-projects.mjs
@@ -71,89 +84,123 @@ jobs:
     name: ${{ matrix.project }} (${{ matrix.os }})
     needs: changes
     if: needs.changes.outputs.projects != '[]'
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 10
+    runs-on: ${{ matrix.os == 'ubuntu-latest' && 'ubuntu-24.04' || matrix.os }}
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
         project: ${{ fromJSON(needs.changes.outputs.projects) }}
 
     steps:
-      - uses: actions/checkout@v7.0.1
-      - uses: pnpm/action-setup@v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           version: 10.17.1
           run_install: false
-      - uses: actions/setup-node@v7.1.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24.21.0
           cache: pnpm
-          cache-dependency-path: ${{ matrix.project }}/pnpm-lock.yaml
+          cache-dependency-path: |
+            ${{ matrix.project }}/pnpm-lock.yaml
+            shared/identity-provider/pnpm-lock.yaml
+      - name: Runner identity
+        run: node shared/tools/repository-automation/ci-report.mjs runner
       - name: Install
+        id: install
+        timeout-minutes: 3
         working-directory: ${{ matrix.project }}
         run: pnpm install --frozen-lockfile
       - name: Prepare shared identity provider
+        id: identity
+        timeout-minutes: 2
         if: matrix.project != 'shared/identity-provider'
         working-directory: shared/identity-provider
         run: |
           pnpm install --frozen-lockfile
           pnpm build
       - name: Install browser and Linux dependencies
+        id: browser-linux
+        timeout-minutes: 7
         if: (matrix.project == 'p1-task-manager' || matrix.project == 'p4-editorial-publishing' || matrix.project == 'p5-dataguard' || matrix.project == 'p6-field-inspection' || matrix.project == 'p7-collaborative-docs' || matrix.project == 'p10-warehouse-workloads' || matrix.project == 'p11-saas-workspace' || matrix.project == 'p14-capital-district' || matrix.project == 'p15-marketplace') && runner.os == 'Linux'
         working-directory: ${{ matrix.project }}
-        run: pnpm exec playwright install --with-deps chromium
+        run: node ../shared/tools/repository-automation/setup-browser.mjs
       - name: Install browser
+        id: browser
+        timeout-minutes: 3
         if: (matrix.project == 'p1-task-manager' || matrix.project == 'p4-editorial-publishing' || matrix.project == 'p5-dataguard' || matrix.project == 'p6-field-inspection' || matrix.project == 'p7-collaborative-docs' || matrix.project == 'p10-warehouse-workloads' || matrix.project == 'p14-capital-district' || matrix.project == 'p15-marketplace') && runner.os != 'Linux'
         working-directory: ${{ matrix.project }}
-        run: pnpm exec playwright install chromium
+        run: pnpm exec playwright install --only-shell chromium
+        env:
+          PLAYWRIGHT_DOWNLOAD_CONNECTION_TIMEOUT: 30000
       - name: Check
+        id: check
+        timeout-minutes: 5
         working-directory: ${{ matrix.project }}
         run: pnpm check
       - name: Run Linux integration scenario
+        id: integration
+        timeout-minutes: 5
         if: runner.os == 'Linux' && (matrix.project == 'p8-cedarfile' || matrix.project == 'p9-cedarrealtime' || matrix.project == 'p11-saas-workspace' || matrix.project == 'p12-hr-access-governance' || matrix.project == 'p13-student-records' || matrix.project == 'p15-marketplace')
         working-directory: ${{ matrix.project }}
         run: pnpm test:e2e
       - name: Audit dependencies
+        id: audit
+        timeout-minutes: 2
         working-directory: ${{ matrix.project }}
         run: pnpm audit --audit-level low
 
+      - name: Verification summary
+        if: always()
+        run: node shared/tools/repository-automation/ci-report.mjs stages
+        env:
+          STEPS_JSON: ${{ toJSON(steps) }}
+
   p3-sidecar:
     name: P3 signed-token sidecar workflow
     needs: changes
     if: contains(fromJSON(needs.changes.outputs.projects), 'p3-mcp-capability-governance')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     defaults:
       run:
         working-directory: p3-mcp-capability-governance
     steps:
-      - uses: actions/checkout@v7.0.1
-      - uses: pnpm/action-setup@v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           version: 10.17.1
           run_install: false
-      - uses: actions/setup-node@v7.1.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24.21.0
           cache: pnpm
-          cache-dependency-path: p3-mcp-capability-governance/pnpm-lock.yaml
+          cache-dependency-path: |
+            p3-mcp-capability-governance/pnpm-lock.yaml
+            shared/identity-provider/pnpm-lock.yaml
       - run: pnpm install --frozen-lockfile
       - run: pnpm test:e2e
 
   compose-config:
     name: Compose startup (${{ matrix.project }})
     needs: changes
     if: needs.changes.outputs.compose != '[]'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
         project: ${{ fromJSON(needs.changes.outputs.compose) }}
     steps:
-      - uses: actions/checkout@v7.0.1
-      - uses: actions/setup-node@v7.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24.21.0
       - name: Validate Compose
@@ -184,12 +231,14 @@ jobs:
   compose-concurrency:
     name: Concurrent project stacks
     needs: changes
-    if: needs.changes.outputs.compose != '[]'
-    runs-on: ubuntu-latest
+    if: needs.changes.outputs.concurrent == 'true'
+    runs-on: ubuntu-24.04
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v7.0.1
-      - uses: actions/setup-node@v7.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24.21.0
       - name: Start independent stacks
@@ -208,3 +257,22 @@ jobs:
           docker compose -f p1-task-manager/compose.yaml down --volumes
           docker compose -f p4-editorial-publishing/compose.yaml down --volumes
           docker compose -f p10-warehouse-workloads/compose.yaml down --volumes
+
+  result:
+    name: Quality result
+    if: always()
+    needs:
+      [changes, step, project, p3-sidecar, compose-config, compose-concurrency]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24.21.0
+      - name: Check selected results
+        run: node shared/tools/repository-automation/ci-result.mjs
+        env:
+          NEEDS_JSON: ${{ toJSON(needs) }}

p1-task-manager/package.json

@@ -28,7 +28,7 @@
     "@fastify/swagger": "9.9.2",
     "@janssenproject/cedarling_wasm": "0.0.468",
     "better-sqlite3": "13.0.3",
-    "fastify": "5.12.5",
+    "fastify": "5.12.6",
     "fflate": "0.8.3",
     "openid-client": "6.8.8",
     "react": "19.3.1",

p10-warehouse-workloads/package.json

@@ -25,7 +25,7 @@
     "@fastify/helmet": "13.2.0",
     "@fastify/static": "10.1.6",
     "better-sqlite3": "13.0.3",
-    "fastify": "5.12.5",
+    "fastify": "5.12.6",
     "jose": "6.2.2",
     "openid-client": "6.8.8",
     "react": "19.3.1",

p14-capital-district/package.json

@@ -27,7 +27,7 @@
     "@fastify/helmet": "13.1.1",
     "@fastify/static": "10.1.5",
     "better-sqlite3": "13.0.3",
-    "fastify": "5.12.5",
+    "fastify": "5.12.6",
     "openid-client": "6.8.8",
     "react": "19.3.0",
     "react-dom": "19.3.0"

p2-tenantrag/package.json

@@ -25,7 +25,7 @@
   "dependencies": {
     "@janssenproject/cedarling_wasm": "0.0.468",
     "@orama/orama": "3.1.18",
-    "fastify": "5.12.5",
+    "fastify": "5.12.6",
     "fflate": "0.8.3",
     "jose": "6.2.10",
     "pdfjs-dist": "6.2.108",