chore: harden repository guardrails

tests/infrastructure.test.ts

@@ -5,6 +5,7 @@ import { describe, expect, it } from "vitest";
 import { parse } from "yaml";
 
 interface ComposeService {
+  environment?: Record<string, string>;
   healthcheck?: unknown;
   image?: string;
   ports?: string[];
@@ -16,6 +17,18 @@ interface ComposeDocument {
   volumes?: Record<string, unknown>;
 }
 
+interface PackageDocument {
+  scripts?: Record<string, string>;
+}
+
+interface TurboDocument {
+  tasks?: Record<string, unknown>;
+}
+
+interface WorkspaceDocument {
+  packages?: string[];
+}
+
 const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
 describe("development infrastructure", () => {
@@ -32,6 +45,7 @@ describe("development infrastructure", () => {
     expect(objectStorage?.image).toBe("chrislusf/seaweedfs:4.28");
     expect(postgres?.healthcheck).toBeDefined();
     expect(objectStorage?.healthcheck).toBeDefined();
+    expect(postgres?.environment?.POSTGRES_INITDB_ARGS).toContain("--auth-host=scram-sha-256");
 
     for (const service of [postgres, objectStorage]) {
       expect(service).toBeDefined();
@@ -44,18 +58,47 @@ describe("development infrastructure", () => {
     expect(compose.volumes).toHaveProperty("object-storage-data");
   });
 
-  it("has a parseable CI workflow with a single repository gate", async () => {
+  it("has a parseable CI workflow with static and live infrastructure gates", async () => {
     const source = await readFile(
       path.join(repositoryRoot, ".github", "workflows", "ci.yml"),
       "utf8",
     );
     const workflow = parse(source) as {
-      jobs?: { verify?: { steps?: Array<{ run?: string }> } };
+      jobs?: {
+        "infrastructure-smoke"?: { steps?: Array<{ run?: string }> };
+        verify?: { steps?: Array<{ run?: string }> };
+      };
     };
     const commands = workflow.jobs?.verify?.steps?.flatMap((step) => step.run ?? []) ?? [];
+    const infrastructureCommands =
+      workflow.jobs?.["infrastructure-smoke"]?.steps?.flatMap((step) => step.run ?? []) ?? [];
 
     expect(workflow.jobs?.verify).toBeDefined();
     expect(commands).toContain("pnpm install --frozen-lockfile");
     expect(commands).toContain("pnpm ci");
+    expect(infrastructureCommands).toContain("bash scripts/smoke-infrastructure.sh");
+  });
+
+  it("includes every official platform layer in the workspace", async () => {
+    const source = await readFile(path.join(repositoryRoot, "pnpm-workspace.yaml"), "utf8");
+    const workspace = parse(source) as WorkspaceDocument;
+
+    expect(workspace.packages).toEqual(
+      expect.arrayContaining(["apps/*", "builders/*", "core", "modules/*", "surfaces/*"]),
+    );
+  });
+
+  it("dispatches root and future package quality tasks through Turborepo", async () => {
+    const packageSource = await readFile(path.join(repositoryRoot, "package.json"), "utf8");
+    const turboSource = await readFile(path.join(repositoryRoot, "turbo.json"), "utf8");
+    const packageDocument = JSON.parse(packageSource) as PackageDocument;
+    const turboDocument = JSON.parse(turboSource) as TurboDocument;
+
+    expect(packageDocument.scripts?.lint).toBe("turbo run lint lint:root");
+    expect(packageDocument.scripts?.test).toBe("turbo run test test:root");
+    expect(packageDocument.scripts?.typecheck).toBe("turbo run typecheck typecheck:root");
+    expect(turboDocument.tasks).toHaveProperty("//#lint:root");
+    expect(turboDocument.tasks).toHaveProperty("//#test:root");
+    expect(turboDocument.tasks).toHaveProperty("//#typecheck:root");
   });
 });