Operations
GitHub Actions workflows, branch protection, verification jobs, E2E artifacts, and CLI release flow.
CentraKit uses a small set of focused GitHub Actions workflows.
.github/workflows/ci.yml runs on pull requests, pushes to main, and manual dispatch. It runs shared repository checks in parallel..github/workflows/release-please.yml runs on pushes to main and opens or updates the CLI release PR..github/workflows/release-cli.yml runs for published CLI releases and manual retries to package the tarball and attach it to the GitHub release..github/dependabot.yml opens weekly npm and GitHub Actions dependency PRs.TURBO_TEAM: Vercel team slug for Turborepo remote cache. Use martijn00.NEXT_PUBLIC_SITE_URL: optional CI override for Next.js env validation. Defaults to https://localhost.NEXT_PUBLIC_SUPABASE_URL: optional CI placeholder override for Next.js env validation.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY: optional CI placeholder override for Next.js env validation.TURBO_TOKEN: optional PAT fallback for remote cache when OIDC is unavailable. Prefer a dedicated token from Vercel → Account Settings → Tokens with Remote Cache Artifact write access (not a short-lived CLI session token). A token whose team role cannot write artifacts produces Insufficient permissions to write to remote cache.SENTRY_AUTH_TOKEN: optional. CI does not upload source maps or create Sentry releases; Vercel production builds do.CI uses vercel/setup-turborepo-remote-cache-action to exchange a GitHub OIDC token for a short-lived Turborepo token. That token is team-scoped and can write cache artifacts. Workflows need id-token: write.
Create the matching Vercel policy once: team Settings → Build and Deployment → OIDC Policies for CLI Access → add a Turborepo CLI policy for martijn00/CentraKit. Until that policy exists, the setup step continues and falls back to TURBO_TOKEN.
gh variable set TURBO_TEAM --body "martijn00" --repo martijn00/CentraKit
gh variable set NEXT_PUBLIC_SITE_URL --body "https://localhost" --repo martijn00/CentraKitVercel deployments do not need TURBO_TOKEN: when builds run turbo run build (configured per service in root vercel.json), Vercel Remote Cache is authenticated automatically. Root turbo.json sets remoteCache.teamSlug / teamId for the linked centrakit project.
From the repo root (one-time per machine):
pnpm exec turbo login
pnpm exec turbo linkThis writes gitignored .turbo/config.json. After linking, local turbo run build shares artifacts with Vercel and GitHub Actions.
Protect main with the stable job names from .github/workflows/ci.yml.
Recommended required checks:
FormatLintKnipTypecheckTestsOpenAPIBuildE2EPayload baseline captures analyzer and CLI size artifacts and compares deterministic SaaS build
metrics with the latest successful main artifact. Regressions emit warnings by default. Set the
PAYLOAD_COMPARE_MODE repository variable to enforce, or choose enforce for a manual workflow
run, to make budget regressions fail the job.
The Payload baseline CI job records shipped-cost artifacts before enforcing size budgets:
pnpm --filter saas baseline:payload runs next experimental-analyze --output after
build, writes .next/diagnostics/payload-artifact.json, and uploads the analyzer output, static
CSS/chunks, manifests, and .nft.json traces.pnpm --filter centrakit baseline:payload packs a baseline tarball and prints dist/cli.js / tarball byte sizes.Locally:
pnpm exec turbo run baseline:payload --filter=saas --filter=./apps/cliThe versioned SaaS artifact records, per audited route, uncompressed production JS, route-only JS after removing chunks shared by every audited route, obtainable prerendered Flight/RSC bytes, server entry bytes, and the unique files/bytes referenced by its NFT trace. Audited routes are Dashboard, Planning, Tasks/all, Products, Admin subscriptions, Audit log, Agenda detail, and Product detail.
CI selects only audited routes affected by changed source paths. A shared App Shell change selects all audited routes. Shared production JS is compared once with a zero-growth budget, so the same shared regression is not repeated for every route. Route budgets allow the larger of the absolute or percentage allowance: 25 KiB/5% route JS, 10 KiB/5% Flight and server entry, and 100 KiB/2% server trace. Missing or schema-incompatible base artifacts warn and skip comparison, including in enforce mode. Runtime timings are intentionally excluded because CI compares build artifacts only.
main run the same check set.pnpm openapi:generate and fails if committed API artifacts drift.Both PR and mainline E2E jobs upload:
tests/playwright-report/tests/blob-report/tests/test-results/Use these artifacts for trace inspection and flake triage before rerunning jobs.
/api/e2e/health route instead of the auth-protected root URL.${{ github.workspace }}/.cache/ms-playwright.Release automation is split into two workflows:
release-please.yml opens or updates the CLI release PR from conventional commits.release-cli.yml packages the tarball and uploads it to the release.release-cli.yml also keeps workflow_dispatch for retrying an asset upload against an existing release tag.