fix(ci): harden release and e2e verification

scripts/__tests__/ci-determinism.test.ts

@@ -21,8 +21,13 @@ type WorkflowStep = {
   with?: Record<string, string | number>;
 };
 
+type WorkflowJob = {
+  env?: Record<string, string>;
+  steps?: WorkflowStep[];
+};
+
 type Workflow = {
-  jobs: Record<string, { steps?: WorkflowStep[] }>;
+  jobs: Record<string, WorkflowJob>;
 };
 
 afterEach(() => {
@@ -58,6 +63,16 @@ describe("Playwright CI determinism", () => {
       "if-no-files-found": "ignore",
     });
   });
+
+  it("uses production-valid secrets and plain-HTTP cookies", () => {
+    const workflow = parse(
+      readRepoFile(".github/workflows/e2e.yml"),
+    ) as Workflow;
+    const env = workflow.jobs.e2e?.env;
+
+    expect(env?.API_TOKEN_HMAC_KEY).toMatch(/^[0-9a-f]{64}$/);
+    expect(env?.SESSION_COOKIE_SECURE).toBe("false");
+  });
 });
 
 describe("integration environment isolation", () => {
@@ -73,7 +88,8 @@ describe("integration environment isolation", () => {
         "0000000000000000000000000000000000000000000000000000000000000000",
       ENCRYPTION_KEYS: "",
       ENCRYPTION_ACTIVE_KEY_ID: "",
-      API_TOKEN_HMAC_KEY: "integration-test-hmac-key-32-bytes-minimum",
+      API_TOKEN_HMAC_KEY:
+        "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
       SESSION_SECRET: "integration-test-session-secret-32-bytes",
     });
     expect(

scripts/__tests__/release-workflows.test.ts

@@ -244,12 +244,18 @@ describe("release container inputs", () => {
     ).toHaveLength(3);
   });
 
-  it("relies on and verifies standalone dependency resolution", () => {
+  it("bundles Prisma's adapter and verifies only runtime externals", () => {
     const dockerfile = readRepoFile("Dockerfile");
+    const nextConfig = readRepoFile("next.config.ts");
     expect(dockerfile).not.toContain("/opt/pg-boss");
     expect(dockerfile).not.toContain('NODE_PATH="/opt/pg-boss/node_modules"');
     expect(dockerfile).toMatch(
-      /require\.resolve\(['"]pg-boss['"]\)[\s\S]*require\.resolve\(['"]@prisma\/adapter-pg['"]\)[\s\S]*require\.resolve\(['"]pg['"]\)/,
+      /require\.resolve\(['"]pg-boss['"]\)[\s\S]*require\.resolve\(['"]pg['"]\)/,
+    );
+    expect(dockerfile).not.toContain("require.resolve('@prisma/adapter-pg')");
+    expect(dockerfile).not.toContain("require.resolve('@prisma/client')");
+    expect(nextConfig).not.toMatch(
+      /serverExternalPackages:\s*\[[\s\S]*["']@prisma\/adapter-pg["']/,
     );
   });
 });
@@ -374,12 +380,16 @@ describe("exact post-publish verification", () => {
     expect(stepScript(workflow, "verify", "Run migrations")).toContain(
       "${IMAGE_REF}@${IMAGE_DIGEST}",
     );
-    expect(stepScript(workflow, "verify", "Start exact image")).toContain(
-      "${IMAGE_REF}@${IMAGE_DIGEST}",
-    );
-    expect(stepScript(workflow, "verify", "Verify exact version")).toContain(
-      'jq -e --arg expected "$IMAGE_TAG"',
+    const startScript = stepScript(workflow, "verify", "Start exact image");
+    expect(startScript).toContain("${IMAGE_REF}@${IMAGE_DIGEST}");
+    expect(startScript).toMatch(/API_TOKEN_HMAC_KEY=[0-9a-f]{64}(?:\s|\\)/);
+    const versionScript = stepScript(
+      workflow,
+      "verify",
+      "Verify exact version",
     );
+    expect(versionScript).toContain('EXPECTED_VERSION="${IMAGE_TAG#v}"');
+    expect(versionScript).toContain('jq -e --arg expected "$EXPECTED_VERSION"');
     expect(stepScript(workflow, "verify", "Verify health")).toContain(
       "jq -e '.status == \"ok\"'",
     );