ci: three-minute PR check and two previews per PR

.github/workflows/browser-nightly.yml

@@ -0,0 +1,62 @@
+name: Browser nightly
+
+# The full credential-free browser suite on desktop and mobile Chromium. Pull
+# requests run only the @smoke subset (deploy.yml), so this catches what the
+# subset skips, at most a day late.
+on:
+  schedule:
+    - cron: "47 2 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: browser-nightly
+  cancel-in-progress: true
+
+jobs:
+  browser-tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+
+      - name: Install Chromium
+        run: npx playwright install --with-deps chromium
+
+      - name: Browser tests
+        env:
+          CI: 1
+          PORT: 18080
+          PLAYWRIGHT_BASE_URL: http://127.0.0.1:18080
+        run: npm run test:e2e
+
+      - name: Upload browser failure artifacts
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: chromium-nightly-failure-${{ github.run_id }}
+          path: |
+            test-results/
+            playwright-report/
+          if-no-files-found: ignore
+          retention-days: 7

.github/workflows/database.yml

@@ -0,0 +1,104 @@
+name: Database
+
+# Local Supabase, pgTAP, and the full-stack browser journeys. About 20 minutes,
+# so pull requests run it only when they touch the backend, the stores and
+# clients that talk to it, or the gate itself. Pushes to main use the same
+# filter, and the weekly run catches frontend-only regressions.
+on:
+  pull_request:
+    paths:
+      - "supabase/**"
+      - "services/collaboration/**"
+      - "src/lib/supabase/**"
+      - "src/lib/stores/**"
+      - "src/lib/ai/**"
+      - "e2e/full-stack/**"
+      - "e2e/workspace-collaboration.spec.ts"
+      - "playwright.workspace.config.ts"
+      - ".superset/db-gate.sh"
+      - ".superset/lib/**"
+      - ".superset/workspace-test.env"
+      - "scripts/test-*.sh"
+      - "scripts/workspace-test-env.mjs"
+      - "package.json"
+      - "package-lock.json"
+      - ".github/workflows/database.yml"
+  push:
+    branches: [ "main" ]
+    paths:
+      - "supabase/**"
+      - "services/collaboration/**"
+      - "src/lib/supabase/**"
+      - "src/lib/stores/**"
+      - "src/lib/ai/**"
+      - "e2e/full-stack/**"
+      - "e2e/workspace-collaboration.spec.ts"
+      - "playwright.workspace.config.ts"
+      - ".superset/db-gate.sh"
+      - ".superset/lib/**"
+      - ".superset/workspace-test.env"
+      - "scripts/test-*.sh"
+      - "scripts/workspace-test-env.mjs"
+      - "package.json"
+      - "package-lock.json"
+      - ".github/workflows/database.yml"
+  schedule:
+    - cron: "23 5 * * 0"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  database-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      - name: Set up Supabase CLI
+        uses: supabase/setup-cli@46f7f98c7f948ad727d22c1e67fab04c223a0520 # v3.0.0
+        with:
+          version: 2.116.0
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+
+      - name: Install Chromium
+        run: npx playwright install --with-deps chromium
+
+      - name: Database and real workspace journey
+        env:
+          # ghcr.io rate-limits shared runners; the same images are on ECR.
+          SUPABASE_INTERNAL_IMAGE_REGISTRY: public.ecr.aws
+          WORKSPACE_GATE_ARTIFACT_ROOT: ${{ runner.temp }}/workspace-gate
+        run: ./.superset/db-gate.sh
+
+      - name: Upload workspace failure artifacts
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: workspace-gate-failure-${{ github.run_id }}
+          path: |
+            ${{ runner.temp }}/workspace-gate/
+            test-results/
+            playwright-report/
+          if-no-files-found: ignore
+          retention-days: 7

.github/workflows/deploy.yml

@@ -4,6 +4,11 @@ on:
   push:
     branches: [ "main" ]
   pull_request:
+    # Docs-only pull requests run docs.yml instead.
+    paths-ignore:
+      - "docs/**"
+      - "plans/**"
+      - "**/*.md"
   workflow_dispatch:
 
 permissions:
@@ -26,6 +31,7 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
+          cache: npm
 
       - name: Install dependencies
         run: npm ci
@@ -46,7 +52,7 @@ jobs:
         run: npm run typecheck
 
       - name: Test
-        run: npm test -- --coverage
+        run: npm test
 
       - name: Collaboration service tests
         run: npm run test:collaboration
@@ -57,7 +63,9 @@ jobs:
       - name: Build
         run: npm run build
 
-  database-tests:
+  # Runs beside quality so the pull-request check takes as long as the slower
+  # of the two. The full desktop and mobile suite runs in browser-nightly.yml.
+  browser-smoke:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
@@ -70,70 +78,32 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
-
-      - name: Set up Supabase CLI
-        uses: supabase/setup-cli@46f7f98c7f948ad727d22c1e67fab04c223a0520 # v3.0.0
-        with:
-          version: 2.116.0
+          cache: npm
 
       - name: Install dependencies
         run: npm ci
 
-      - name: Install Chromium
-        run: npx playwright install --with-deps chromium
-
-      - name: Database and real workspace journey
-        env:
-          # ghcr.io rate-limits shared runners; the same images are on ECR.
-          SUPABASE_INTERNAL_IMAGE_REGISTRY: public.ecr.aws
-          WORKSPACE_GATE_ARTIFACT_ROOT: ${{ runner.temp }}/workspace-gate
-        run: ./.superset/db-gate.sh
-
-      - name: Upload workspace failure artifacts
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: workspace-gate-failure-${{ github.run_id }}
-          path: |
-            ${{ runner.temp }}/workspace-gate/
-            test-results/
-            playwright-report/
-          if-no-files-found: ignore
-          retention-days: 7
-
-  browser-tests:
-    if: github.event_name == 'pull_request'
-    needs: quality
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Cache Playwright browsers
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
-          persist-credentials: false
-
-      - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 22
-
-      - name: Install dependencies
-        run: npm ci
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
 
       - name: Install Chromium
         run: npx playwright install --with-deps chromium
 
-      - name: Browser tests
+      - name: Browser smoke tests
         env:
           CI: 1
           PORT: 18080
           PLAYWRIGHT_BASE_URL: http://127.0.0.1:18080
-        run: npm run test:e2e
+        run: npm run test:e2e:smoke
 
       - name: Upload browser failure artifacts
         if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: chromium-browser-failure-${{ github.run_id }}
+          name: chromium-smoke-failure-${{ github.run_id }}
           path: |
             test-results/
             playwright-report/

.github/workflows/docs.yml

@@ -0,0 +1,29 @@
+name: Docs
+
+# Docs-only pull requests skip the Quality workflow, so they get this check.
+on:
+  pull_request:
+    paths:
+      - "docs/**"
+      - "plans/**"
+      - "**/*.md"
+
+permissions:
+  contents: read
+
+jobs:
+  docs:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      - name: Documentation
+        run: npm run docs:check

.github/workflows/live-e2e.yml

@@ -1,9 +1,17 @@
 name: Live provider E2E
 
-# Real OpenRouter, Jev, and Exa behind the local stack. Runs on pull requests,
-# nightly to catch provider drift without code changes, and on demand.
+# Real OpenRouter, Jev, and Exa behind the local stack. Every run spends
+# provider credit, so pull requests run it only when AI or research code
+# changes. Nightly runs catch provider drift without code changes.
 on:
   pull_request:
+    paths:
+      - "supabase/functions/**"
+      - "src/lib/ai/**"
+      - "e2e/live/**"
+      - "e2e/full-stack/fake-openrouter.mjs"
+      - ".superset/db-gate.sh"
+      - ".github/workflows/live-e2e.yml"
   schedule:
     - cron: "17 3 * * *"
   workflow_dispatch:

AGENTS.md

@@ -42,14 +42,14 @@ Run the smallest relevant check first:
 npm run docs:check
 npm run lint
 npm run typecheck
-npm test -- --coverage
+npm test
 npm run test:collaboration
 npm run test:edge
 npm run build
 P=$(bash .superset/e2e-port.sh) && CI=1 PORT=$P PLAYWRIGHT_BASE_URL=http://127.0.0.1:$P npm run test:e2e
 ```
 
-`npm run verify` runs the complete credential-free ladder, including desktop and mobile Chromium against a fresh Vite server.
+`npm run verify` runs the credential-free ladder with the desktop Chromium `@smoke` browser set (about a minute). `npm run verify:full` adds the full desktop and mobile suite.
 
 If GitHub Actions jobs fail within 2 to 5 seconds with no logs, they did not run: the account is out of Actions minutes (billing), not failing on the code. In that case run the same checks locally at the final head (`npm run verify` and the database gate) and record the exact results in the PR. A local pass is not a CI pass; say which one you have.
 

README.md

@@ -41,9 +41,10 @@ Vite serves on port `8080` by default. In a Superset workspace or other linked w
 ```bash
 npm run lint
 npm run typecheck
-npm test -- --coverage
+npm test
 npm run build
-npm run verify         # full credential-free gate, including desktop and mobile Chromium
+npm run verify         # credential-free gate with the desktop Chromium smoke set
+npm run verify:full    # adds the full desktop and mobile browser suite
 ./.superset/db-gate.sh # migrations, pgTAP, and full-stack journeys on local Supabase
 ```