Basilic
Deployment

GitHub Actions

Continuous integration workflows for automated testing, linting, and security checks.

GitHub Actions workflows automate quality checks on pull requests (opened and updated).

Workflows

Path filters are used only for test workflows (app E2E and package unit tests) so they run when relevant code changes. Lint, security.yml, conventional PR title, template classification, generator tests, and release-impact run on every PR (always reportable; they do not use path filters that leave required checks pending). DeepSec runs on same-repo PRs from OWNER, MEMBER, or COLLABORATOR. Path patterns are defined in each workflow file.

Web (web-e2e.yml)

Build → E2E. Triggers on pull request when apps/web/**, API routes the suite exercises (auth, account, ai, health, test), shared packages, OpenAPI, or the workflow/action files change. Single job: build (with localhost API URL), then E2E via test:e2e:local with SKIP_BUILD=1 (spawns Fastify + Next with ALLOW_TEST=true, RATE_LIMIT_MAX=10000, and WEBAUTHN_RP_NAME=Test App). The chat Playwright project runs only when a non-placeholder Anthropic key is present (hasRealAnthropicKey(): empty, sk-ant-xxx, and sk-ant-dummy* omit it); forks without that secret still run auth and dashboard E2E. cancel-in-progress: true. Sets TURBO_TOKEN / TURBO_TEAM when configured.

API (api-e2e.yml)

Two parallel jobs when apps/api/** or shared packages change:

  • unit — OpenAPI drift check (pnpm generate && git diff --exit-code), then pnpm --filter @repo/api test:cov. Uploads api-vitest-coverage artifact. No API tsc build (Vitest runs TypeScript source; lint.yml runs checktypes). Does not require ANTHROPIC_API_KEY; remote AI tests skip when the secret is absent.
  • e2e — Scalar login E2E via test:e2e:local (builds @repo/api deps, spawns API with RATE_LIMIT_MAX=10000; does not require ANTHROPIC_API_KEY).

cancel-in-progress: true.

Packages (packages-test.yml)

Unit tests for packages that define a test script (core, react, error). Triggers on pull request when packages/**, tools/**, apps/api/openapi/**, or the workflow/action files change. Uses committed OpenAPI artifacts (no Fastify boot). Excludes app tests (handled by api-e2e, web-e2e). Sets TURBO_TOKEN / TURBO_TEAM when configured.

API drift check (api-e2e.yml)

When apps/api/** changes, the unit job runs pnpm generate && git diff --exit-code on openapi.json and packages/core/src/gen before Vitest.

Docu (Vercel)

No dedicated CI workflow. Docu deploys via Vercel from Git with turbo-ignore; builds run only when apps/docu/** or shared packages change.

See E2E Testing for details.

Inspect with gh

Use the GitHub CLI for PR checks and failed workflow logs — not GitHub MCP:

gh pr checks
gh run list --branch "$(git branch --show-current)" --limit 5
gh run view <run-id> --log-failed

Lint (lint.yml)

Linting and type checking on every PR (pnpm lint, then pnpm exec turbo run checktypes). Supports workflow_dispatch for manual runs. Sets TURBO_TOKEN / TURBO_TEAM when configured.

Scaffold (pr-title.yml, scaffold.yml, release-impact.yml, scaffold-acceptance.yml)

Always report on pull requests:

  • PR title — conventional types (feat, fix, perf, …).
  • Template classification — every git ls-files path is include / transform / exclude.
  • Generator tests — create-basilic unit tests on Ubuntu, macOS, and Windows (copy/generate). Full-stack Product Ready remains Unix-oriented.
  • Release impact — payload path changes behind docs/chore/test/ci/style titles fail unless the body has skip-release: true.

Generated tree QA (scaffold-acceptance.yml) runs the assembled template’s pnpm qa (types, lint, OpenAPI drift, build, unit, API/web E2E) on release-please PRs and workflow_dispatch. Feature PRs skip that job with success so the required check is not pending.

Release Please and publish

Upstream only (excluded from generated trees): release-please.yml on main (GitHub App token), publish-create-basilic.yml on v* tags (OIDC npm publish + GitHub Release asset). See Publishing.

Mobile (mobile-build.yml, mobile-preview.yml, mobile-pr-preview.yml)

EAS builds and PR OTA previews for the Expo app. Requires EXPO_TOKEN in GitHub Secrets. v1: Android-only, no store submission.

  • mobile-build: Manual trigger. Builds Android preview or development profile.
  • mobile-preview: Push to main (paths: apps/mobile/**, packages/ui/**). Builds Android preview; refreshes baseline for OTA.
  • mobile-pr-preview: Pull request (paths: apps/mobile/**, packages/ui/**). Publishes EAS Update, comments QR code. Reviewers must install baseline preview APK first; then scan QR to load PR update.

See Mobile CI/CD for setup, reviewer bootstrap, and JS-only OTA limits.

Security (security.yml)

Security scans (gitleaks, TruffleHog, OSV Scanner, pnpm audit) on every PR and push to main. pnpm audit uses --ignore-registry-errors so npm registry timeouts and HTTP errors are not treated as findings; OSV still fails the job on known CVEs. DeepSec is not in this workflow; see DeepSec (deepsec.yml).

DeepSec (deepsec.yml)

Source-code review of the PR diff on same-repo pull requests from OWNER, MEMBER, or COLLABORATOR. Forks and untrusted authors skip (no secrets). analyze receives AI_GATEWAY_API_KEY only after that trusted-author gate (GitHub also requires a maintainer to approve workflow runs from first-time contributors). Two jobs:

  1. analyze — contents: read only. Skipped when AI_GATEWAY_API_KEY is not set or the author is untrusted. Checks out the PR for scan input, overlays .deepsec from the PR base SHA when that tree exists (bootstrap uses the PR workspace if .deepsec is not on the base), writes credentials to .deepsec/.env.local, runs Codex process --files-from on files from git diff BASE_SHA...HEAD with GPT-5.6 Sol via Vercel AI Gateway. Fails on net-new findings. Local alternate: Grok 4.6 on DeepSec pi (pnpm security:deepsec:process:diff:grok).
  2. comment — pull-requests: write. Posts the findings comment. Never checks out or executes PR code. Never receives AI_GATEWAY_API_KEY.

Full-repo DeepSec review stays local. See Security.

CodeRabbit Integration

CodeRabbit automatically reviews pull requests using AI. Configuration is in .coderabbit.yaml:

# .coderabbit.yaml (simplified)
language: en-US
reviews:
  auto_review: true
  high_level_summary: true

See the complete .coderabbit.yaml in the repository root for full configuration.

Caching

  • pnpm — lint, packages-test, api-e2e, web-e2e, and security use .github/actions/setup-pnpm (actions/setup-node with cache: pnpm).
  • Playwright — web-e2e uses .github/actions/setup-playwright (caches ~/.cache/ms-playwright, installs Chromium for @repo/api and @repo/web). api-e2e e2e still installs Playwright inline with the same cache key.
  • Next.js — web-e2e caches apps/web/.next/cache.
  • Turbo — caches build, checktypes, and lint:eslint; not test / test:unit / test:e2e.
  • Turbo remote cache (optional) — set TURBO_TOKEN (secret) and TURBO_TEAM (variable) after creating a Vercel Remote Cache token. Wired on lint.yml, packages-test.yml, and web-e2e.yml. Vercel deploys can reuse the same token. See Development Tooling.

Pre-commit Hooks

Local quality checks run before each commit:

// package.json (simplified)
{
  "simple-git-hooks": {
    "pre-commit": "pnpm run hooks:pre-commit"
  }
}

Pre-commit hooks check:

  1. File blocking — sensitive files (.env, *.pem, …)
  2. Secret scanning — gitleaks on staged files
  3. OSV — dependency CVEs
  4. Formatting — Biome on staged files

Deployment

GitHub Flow, CI, Vercel, mobile, and package publishing.

Mobile CI/CD

EAS builds, preview distribution, and PR OTA updates for the Expo app. Android-only v1.

On this page

WorkflowsWeb (web-e2e.yml)API (api-e2e.yml)Packages (packages-test.yml)API drift check (api-e2e.yml)Docu (Vercel)Inspect with ghLint (lint.yml)Scaffold (pr-title.yml, scaffold.yml, release-impact.yml, scaffold-acceptance.yml)Release Please and publishMobile (mobile-build.yml, mobile-preview.yml, mobile-pr-preview.yml)Security (security.yml)DeepSec (deepsec.yml)CodeRabbit IntegrationCachingPre-commit HooksRelated Documentation