Bugfix/e2e stress test fixes

.env.example

@@ -0,0 +1,62 @@
+# Local dev server configuration
+DEV_SERVER_PORT="4321"
+
+# For Docker Compose use with container mocks for E2E setup
+COMPOSE_PROJECT_NAME="wb-e2e"
+
+# Mock ConvertKit API (WireMock container that backs E2E tests local
+# and on GitHub Actions, production on Vercel)
+CONVERTKIT_HTTP_PORT="9010"
+CONVERTKIT_API_KEY="mock-convertkit-key"
+CONVERTKIT_FORM_ID="100000"
+
+# Vercel automatically sends the CRON_SECRET as an Authorization header
+# when it invokes your cron job. Your endpoint can then verify this secret
+# to ensure the request originated from Vercel.
+CRON_SECRET="local-cron-secret"
+
+# Mock Resend API (WireMock container that backs transactional email tests
+# local and on GitHub Actions, production on Vercel)
+RESEND_HTTP_PORT="9011"
+RESEND_API_KEY="mock-resend-key"
+
+# Upstash-compatible Redis mock for rate limits + cron keepalive keys (local
+# and on GitHub Actions, production on Vercel)
+UPSTASH_HTTP_PORT="8079"
+UPSTASH_REDIS_PORT="6380"
+UPSTASH_TOKEN="local-dev-token"
+
+# Vercel Marketplace Integration for Upstash Redis used with rate limiting on API endpoints
+# (local and on GitHub Actions, production on Vercel)
+KV_URL="redis://default:local-dev-token@127.0.0.1:6380"
+KV_REST_API_URL="http://127.0.0.1:8079"
+KV_REST_API_TOKEN="local-dev-token"
+KV_REST_API_READ_ONLY_TOKEN="local-dev-token"
+REDIS_URL="redis://default:local-dev-token@127.0.0.1:6380"
+
+# Supabase configuration
+# - SUPABASE_URL / SUPABASE_KEY: client + server runtime credentials used in Astro and API routes.
+# - SUPABASE_SERVICE_ROLE_KEY: server-side key for tests and cron endpoints (never expose to browser).
+# - SUPABASE_HEALTH_TIMEOUT: controls how long we wait for the local Supabase container to become healthy.
+# - SUPABASE_DB_PASSWORD / SUPABASE_PROJECT_REF / SUPABASE_ACCESS_TOKEN: only needed when pushing
+#   migrations to the hosted project (GitHub "build" workflow). Leave them empty locally unless you
+#   have production access.
+SUPABASE_HEALTH_TIMEOUT="240"
+SUPABASE_URL="http://127.0.0.1:54321"
+SUPABASE_KEY="sb_publishable_example"
+SUPABASE_SERVICE_ROLE_KEY="sb_secret_example"
+SUPABASE_DB_PASSWORD="example-db-password"
+SUPABASE_PROJECT_REF="exampleprojectref"
+SUPABASE_ACCESS_TOKEN="sbp_example_personal_access_token"
+
+# Observability / external services
+SENTRY_AUTH_TOKEN="dev-placeholder-sentry-token"
+SENTRY_DSN="https://examplePublicKey@o0.ingest.sentry.io/0"
+
+# Vercel deployment vars
+VERCEL_TOKEN="p1vT5d4M1H2q0NjEtR9bJVxu"
+VERCEL_PROJECT_ID="prj_d24xWkR5sY8pMn2qBcLe8F0Z"
+VERCEL_ORG_ID="team_C7kQw5vXn0PfH3sJt2Gb9LrY"
+
+# Used for social shares on Mastodon
+WEBMENTION_IO_TOKEN="dev-webmention-token"

.github/dependabot.yml

@@ -5,11 +5,20 @@ updates:
     versioning-strategy: "increase"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 4
+    open-pull-requests-limit: 1
     labels:
       - "type: dependencies 🔗"
       - "automerge 🤞"
+    groups:
+      npm-dependencies:
+        patterns:
+          - "*"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 1
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/branch-protection.yml

@@ -10,8 +10,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check branch naming convention
+        env:
+          BRANCH_NAME: ${{ github.head_ref }}
         run: |
-          BRANCH_NAME="${{ github.head_ref }}"
+          : "${BRANCH_NAME:?github.head_ref is required}"
 
           # Valid patterns: bugfix/, hotfix/, feature/, infrastructure/, maintenance/, content/
           if [[ ! $BRANCH_NAME =~ ^(bugfix|hotfix|feature|infrastructure|maintenance|content)/[a-z0-9-]+$ ]]; then
@@ -36,8 +38,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Ensure PR targets main
+        env:
+          TARGET_BRANCH: ${{ github.base_ref }}
         run: |
-          TARGET_BRANCH="${{ github.base_ref }}"
+          : "${TARGET_BRANCH:?github.base_ref is required}"
 
           if [[ "$TARGET_BRANCH" != "main" ]]; then
             echo "⚠️  Warning: PR is targeting '$TARGET_BRANCH' instead of 'main'"