ci: run vitest test suite in build workflow

[dobby-coder]

The vitest suite (10 test files, 156 passing tests at HEAD) is not executed in CI. .github/workflows/build.yml runs only npm run typecheck and npm run build. As a result, a PR that breaks the unit tests can pass CI green.

Reproduction

$ grep -n "test\|vitest" .github/workflows/build.yml
# (no `npm test` step)

npm test works locally:

$ npm test
 Test Files  10 passed (10)
      Tests  156 passed (156)
   Duration  ~700ms

Fix

Add a step in the build job, between Type check and Build extension:

- name: Run tests
  run: npm test

The tests are pure (no network, browser API is mocked via tests/helpers/browser-mock.ts) and finish in well under a second, so this is essentially free.

Why now

The recent test-extraction work (PRs #110-#117) produced a substantial suite. PR #105 tracked the previous "108 it.todo placeholders" problem and is now closed because the placeholders have been replaced by real assertions. Pinning that suite in CI is the natural follow-up.

Acceptance criteria

• .github/workflows/build.yml runs npm test before the build/package steps.
• A PR that intentionally breaks one test fails the build job.

[dobby-coder]

/dobby

[dobby-coder]

Dobby has received the request! Routing to the right specialist now...

[dobby-coder]

Plan

Add a Run tests step in .github/workflows/build.yml between the existing Type check and Build extension steps in the build job.

Change

      - name: Type check
        run: npm run typecheck

      - name: Run tests           # ← new
        run: npm test             # ← new

      - name: Build extension
        run: npm run build

That's the entire diff.

Why this placement

• After npm ci (deps installed).
• After Type check (cheap, ~ms; surfaces type errors first so test failures aren't mistaken for type drift).
• Before Build extension and Package .xpi (fail fast — don't waste build/package time if tests are red).

Verified locally

$ npm test
Test Files  10 passed (10)
     Tests  156 passed (156)
  Duration  726ms

Tests are pure (browser API mocked via tests/helpers/browser-mock.ts, no network), so this adds < 1s to CI.

Acceptance criteria coverage

• ✅ .github/workflows/build.yml runs npm test before build/package.
• ✅ A PR that breaks one test will fail the build job (vitest exits non-zero, so the workflow step fails).

Files touched

• .github/workflows/build.yml (one new step, 2 lines)

I'll open a draft PR off main and link this issue.

[dobby-coder]

Blocked: cannot push workflow file changes

dobby-coder[bot] lacks the workflows: write permission on this App installation, so a push to .github/workflows/build.yml is rejected by GitHub:

! [remote rejected] ci/run-vitest-in-build -> ci/run-vitest-in-build
  (refusing to allow a GitHub App to create or update workflow
  `.github/workflows/build.yml` without `workflows` permission)

This is a recurring blocker (org-wide) — workflow edits need to be applied by a human, or workflows: write granted on the App installation.

Patch to apply

Diff (verified locally — npm test → 156/156 passing in ~700ms):

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 06e2ff7..dc3c98e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -93,6 +93,9 @@ jobs:
       - name: Type check
         run: npm run typecheck
 
+      - name: Run tests
+        run: npm test
+
       - name: Build extension
         run: npm run build
         env:

One-liner apply

git checkout -b ci/run-vitest-in-build
git apply <<'PATCH'
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 06e2ff7..dc3c98e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -93,6 +93,9 @@ jobs:
       - name: Type check
         run: npm run typecheck
 
+      - name: Run tests
+        run: npm test
+
       - name: Build extension
         run: npm run build
         env:
PATCH
git add .github/workflows/build.yml
git commit -m "ci: run vitest suite in build workflow

Closes #126"
git push -u origin ci/run-vitest-in-build
gh pr create --fill --base main

Or even simpler

In .github/workflows/build.yml, between the existing Type check and Build extension steps, insert:

      - name: Run tests
        run: npm test

That's the entire change — both acceptance criteria are met:

• ✅ npm test runs before the build/package steps.
• ✅ A PR that breaks one test will fail the build job (vitest exits non-zero).

[rubenhensen]

/dobby please pick this up — the body already has the repro and fix plan: wire npm test into build.yml so the 156-test vitest suite gates PRs. Part of encryption4all/postguard#247 wave 1.

[dobby-coder]

Got it — I'm on this now. I'll wire npm test into build.yml so the 156-test vitest suite gates PRs, following the repro/fix plan in the issue body, and open up a draft PR with the change.

[dobby-coder]

Hey @rubenhensen — I've got the fix ready, but I hit the same wall as before: GitHub still won't let this App push to .github/workflows/ without workflows permission, so I couldn't open a PR.

The change itself is tiny — one step added to build.yml between Type check and Build extension:

      - name: Run tests
        run: npm test

That applies cleanly on top of main at d5c2028. I verified locally that the suite is green (15 files, 212 tests, 2.4s — it's grown since the issue was written) and that a broken assertion makes npm test exit 1, which fails the step, so it does gate the build.

One small follow-up for whoever lands this: the "Tests not gated in CI" note in CLAUDE.md will need updating since it'll no longer be true.

Since this is the second time this exact permission has blocked a CI PR, it'd save a round of copy-pasting if the Dobby App got workflows: write on the encryption4all installation: https://github.com/organizations/encryption4all/settings/installations