test(ci): Phase 0 — wire orphaned tests, inventory guard, WDIO reset, gate fixes (#4492)

.github/workflows/pr-ci.yml

@@ -58,6 +58,13 @@ jobs:
       # scripts/ci/rust-coverage-changed.sh (domain-scoped llvm-cov).
       rust-core-src-files: ${{ steps.filter.outputs['rust-core-src_files'] }}
       rust-tauri: ${{ steps.filter.outputs['rust-tauri'] }}
+      # Mock backend + shared scripts → run the scripts self-test suite.
+      scripts: ${{ steps.filter.outputs.scripts }}
+      # Test wiring surface (workflows, package.json, all.rs, tests/, script
+      # tests) → run the test-inventory orphan + controller-domain guard.
+      inventory: ${{ steps.filter.outputs.inventory }}
+      # Windows installer or its unit test → run the Pester install lane.
+      install-ps1: ${{ steps.filter.outputs.install_ps1 }}
       coverage: ${{ steps.filter.outputs.frontend == 'true' || steps.filter.outputs['rust-core'] == 'true' || steps.filter.outputs['rust-tauri'] == 'true' }}
     steps:
       - name: Checkout code
@@ -144,6 +151,30 @@ jobs:
               - 'rust-toolchain.toml'
               - 'app/src-tauri/**'
               - 'scripts/ci-cancel-aware.sh'
+            # Shared mock backend + script self-tests. The mock backend every
+            # E2E suite depends on had zero PR-lane coverage before this (its
+            # own socket-auth tests never ran in CI) — arm the scripts
+            # self-test job on any mock/script change.
+            scripts:
+              - '.github/workflows/pr-ci.yml'
+              - 'scripts/mock-api/**'
+              - 'scripts/*.mjs'
+              - 'scripts/__tests__/**'
+            # Test-wiring surface: a change here can orphan a test or add an
+            # untested controller domain → run the inventory guard.
+            inventory:
+              - '.github/workflows/**'
+              - 'package.json'
+              - 'src/core/all.rs'
+              - 'tests/**'
+              - 'scripts/**/*.test.mjs'
+              - 'scripts/tests/**'
+              - 'scripts/generate-test-inventory.mjs'
+            # Windows installer + its Pester unit test.
+            install_ps1:
+              - '.github/workflows/pr-ci.yml'
+              - 'scripts/install.ps1'
+              - 'scripts/tests/OpenHumanWindowsInstall.Tests.ps1'
 
   frontend-checks:
     name: Frontend Checks (quality, i18n, docs, coverage)
@@ -462,6 +493,87 @@ jobs:
           retention-days: 7
           if-no-files-found: error
 
+  scripts-tests:
+    name: Scripts Self-Tests (mock backend + CLIs)
+    needs: [changes]
+    if: needs.changes.outputs.scripts == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    container:
+      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Cache pnpm store
+        id: pnpm-cache
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: .pnpm-store
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            pnpm-store-${{ runner.os }}-
+
+      # The socket self-tests resolve socket.io-client from app/, so the
+      # workspace deps must be installed.
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Save pnpm store cache
+        if: always() && steps.pnpm-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: .pnpm-store
+          key: ${{ steps.pnpm-cache.outputs.cache-primary-key }}
+
+      - name: Run mock-backend + script self-tests
+        run: pnpm test:scripts
+
+  test-inventory:
+    name: Test Inventory (orphan + controller-domain guard)
+    needs: [changes]
+    if: needs.changes.outputs.inventory == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    container:
+      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      # Node-only guard (no workspace deps): asserts every script-level test is
+      # invoked by a package.json script/workflow, and every controller domain
+      # in src/core/all.rs is referenced under tests/.
+      - name: Run test-inventory guard
+        run: pnpm test:inventory
+
+  pester-install:
+    name: PowerShell Install Test (Pester)
+    needs: [changes]
+    if: needs.changes.outputs['install-ps1'] == 'true'
+    # GitHub-hosted ubuntu-latest ships pwsh; the test only dot-sources
+    # install.ps1 helpers (no MSI, cross-platform), so no Windows runner needed.
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      # Invoked directly (not via `pnpm test:install-ps1`) so the lane needs no
+      # Node/pnpm toolchain — pwsh is preinstalled on ubuntu-latest. Keep this
+      # command in sync with the `test:install-ps1` package.json script.
+      - name: Run install.ps1 unit tests
+        run: pwsh -NoProfile -File scripts/tests/OpenHumanWindowsInstall.Tests.ps1
+
   pr-ci-gate:
     name: PR CI Gate
     needs:
@@ -470,6 +582,9 @@ jobs:
       - rust-quality
       - rust-core-coverage
       - rust-tauri-coverage
+      - scripts-tests
+      - test-inventory
+      - pester-install
     if: always()
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -483,6 +598,9 @@ jobs:
             ["Rust Quality"]="${{ needs['rust-quality'].result }}"
             ["Rust Core Coverage"]="${{ needs['rust-core-coverage'].result }}"
             ["Rust Tauri Coverage"]="${{ needs['rust-tauri-coverage'].result }}"
+            ["Scripts Self-Tests"]="${{ needs['scripts-tests'].result }}"
+            ["Test Inventory"]="${{ needs['test-inventory'].result }}"
+            ["PowerShell Install Test"]="${{ needs['pester-install'].result }}"
           )
 
           failed=0

.github/workflows/release-ci.yml

@@ -309,7 +309,14 @@ jobs:
       - unit-tests
       - rust-e2e
       - build-playwright-e2e-artifact
-      - playwright-e2e
+      # `playwright-e2e` is intentionally EXCLUDED from the gate. It carries
+      # `continue-on-error: true` (flaky specs, TODO #3615), which makes the
+      # job report `success` to `needs` even when its steps fail — so listing
+      # it here would be a can-never-fail check that only reads as coverage.
+      # Rather than leave it decorative, we drop it from the gate until the
+      # specs are stabilised and the flag removed (#3615); the lane still runs
+      # for signal, and `build-playwright-e2e-artifact` (which CAN fail) stays
+      # gated so a broken web build is still caught.
       - e2e-desktop
     if: always()
     runs-on: ubuntu-latest
@@ -318,11 +325,13 @@ jobs:
       - name: Require all Release CI jobs to pass
         run: |
           set -euo pipefail
+          # NOTE: "Playwright E2E" is deliberately absent — see the needs:
+          # comment above (#3615). Re-add it here once continue-on-error is
+          # removed from the playwright-e2e job.
           declare -A results=(
             ["Full Unit Suites"]="${{ needs['unit-tests'].result }}"
             ["Rust E2E"]="${{ needs['rust-e2e'].result }}"
             ["Build Playwright E2E Artifact"]="${{ needs['build-playwright-e2e-artifact'].result }}"
-            ["Playwright E2E"]="${{ needs['playwright-e2e'].result }}"
             ["Desktop E2E"]="${{ needs['e2e-desktop'].result }}"
           )