Prompt 10: production readiness, SBOM, DPIA, final polish #16

	name: CI

	on:
	push:
	branches:
	- main
	pull_request:

	jobs:
	validate:
	runs-on: ubuntu-latest

	steps:
	- name: Check out repository
	uses: actions/checkout@v4

	- name: Set up pnpm
	uses: pnpm/action-setup@v4

	- name: Set up Node.js
	uses: actions/setup-node@v4
	with:
	node-version: 20
	cache: pnpm

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	- name: Lint
	run: pnpm lint

	- name: Typecheck
	run: pnpm typecheck

	- name: Test
	run: pnpm test

	- name: Build web app
	run: pnpm --filter web build

	e2e:
	runs-on: ubuntu-latest
	needs: validate
	continue-on-error: true

	steps:
	- name: Check out repository
	uses: actions/checkout@v4

	- name: Set up pnpm
	uses: pnpm/action-setup@v4

	- name: Set up Node.js
	uses: actions/setup-node@v4
	with:
	node-version: 20
	cache: pnpm

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	- name: Install Playwright browsers
	run: pnpm exec playwright install --with-deps chromium

	- name: Build web app
	run: pnpm --filter web build

	- name: Start preview server
	run: pnpm --filter web exec vite preview --host 127.0.0.1 --port 4174 &

	- name: Wait for preview server
	run: \|
	for attempt in {1..30}; do
	if curl -sf http://127.0.0.1:4174 >/dev/null; then
	exit 0
	fi
	sleep 2
	done
	echo "Preview server did not become ready in time."
	exit 1

	- name: Run e2e tests
	run: PW_SKIP_WEBSERVER=1 pnpm test:e2e --grep-invert @slow

	- name: Upload Playwright artifacts
	if: failure()
	uses: actions/upload-artifact@v4
	with:
	name: playwright-results
	path: \|
	playwright-report
	test-results

Provide feedback