From 77b0f3a0f92c41124551da101a4faf9a31464c82 Mon Sep 17 00:00:00 2001
From: Daniel Volz <mail@danielvolz.org>
Date: Fri, 13 Feb 2026 19:52:33 +0100
Subject: [PATCH] chore: improve dev tooling (CI tests, dependabot, coverage)
 (#169)

- Add frontend unit tests with coverage to CI test workflow
- Add dependabot.yml for automated dependency updates (npm + GitHub Actions)
- Add backend coverage thresholds (60/65/50/60) to vitest.config.ts
- Exclude services/ and logger from coverage (untestable schedulers)
---
 .github/copilot-instructions.md |  2 +-
 .github/dependabot.yml          | 53 +++++++++++++++++++++++++++++++++
 .github/workflows/test.yml      | 13 +++++++-
 backend/vitest.config.ts        | 20 +++++++++++++
 4 files changed, 86 insertions(+), 2 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 7ef5763..545df0e 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -8,7 +8,7 @@ Use `AGENTS.md` as the canonical governance source and `.github/skills/*/SKILL.m
 ## Always-On Rules
 
 - English only for project artifacts.
-- No remote git/release actions by normal agent (`git push`, PR create/merge, tag/release).
+- **NEVER run remote git commands** — no `git push`, no `gh pr create/merge`, no `gh release`, no `git tag`. Prepare locally, then hand off to `@release-manager`.
 - Testing work belongs to `@testing-manager`.
 - PR/release/CI orchestration belongs to `@release-manager`.
 - Keep changes local, focused, and consistent with existing UI/API patterns.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..06cea28
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,53 @@
+version: 2
+
+updates:
+  # Backend dependencies
+  - package-ecosystem: "npm"
+    directory: "/backend"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+    groups:
+      minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Frontend dependencies
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+    groups:
+      minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Root dev dependencies
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "ci"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 22c614f..88b64ab 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -81,7 +81,7 @@ jobs:
           retention-days: 7
 
   # =============================================================================
-  # Frontend Build Validation (skipped if no frontend-related files changed)
+  # Frontend Tests & Build (skipped if no frontend-related files changed)
   # =============================================================================
   frontend-build:
     name: Frontend Build
@@ -111,5 +111,16 @@ jobs:
       - name: Lint
         run: npm run lint
 
+      - name: Run tests with coverage
+        run: npm run test:coverage
+
       - name: TypeScript type check & build
         run: npm run build
+
+      - name: Upload coverage report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: frontend-coverage
+          path: frontend/coverage/
+          retention-days: 7
diff --git a/backend/vitest.config.ts b/backend/vitest.config.ts
index 9f50a69..bd731c6 100644
--- a/backend/vitest.config.ts
+++ b/backend/vitest.config.ts
@@ -14,5 +14,25 @@ export default defineConfig({
     },
     // Timeout for longer integration tests
     testTimeout: 10000,
+    coverage: {
+      provider: "v8",
+      reporter: ["text", "json", "html"],
+      include: ["src/**/*.ts"],
+      exclude: [
+        "src/test/**",
+        "src/**/*.d.ts",
+        "src/**/index.ts",
+        "src/services/**",
+        "src/utils/logger.ts",
+      ],
+      thresholds: {
+        global: {
+          lines: 60,
+          functions: 65,
+          branches: 50,
+          statements: 60,
+        },
+      },
+    },
   },
 });