From 3940a225050a5b3aeaf43968cf2e85e131416b0c Mon Sep 17 00:00:00 2001
From: Daniel Roe <daniel@roe.dev>
Date: Sat, 1 Aug 2026 18:48:12 +0100
Subject: [PATCH] ci: add test workflows

---
 .tangled/workflows/browser.yml | 33 ++++++++++++++++++++++++++++++
 .tangled/workflows/test.yml    | 37 ++++++++++++++++++++++++++++++++++
 2 files changed, 70 insertions(+)
 create mode 100644 .tangled/workflows/browser.yml
 create mode 100644 .tangled/workflows/test.yml

diff --git a/.tangled/workflows/browser.yml b/.tangled/workflows/browser.yml
new file mode 100644
index 0000000..763b089
--- /dev/null
+++ b/.tangled/workflows/browser.yml
@@ -0,0 +1,33 @@
+# Browser tests: the `nuxt` vitest project (browser mode) and the Playwright
+# end-to-end suite.
+#
+# These run inside the pinned `mcr.microsoft.com/playwright` image rather than
+# directly on the guest, because the screenshot baselines in `tests/` are
+# generated against that image's font stack (see `test:browser:update`). The
+# image tag must stay in sync with the `@playwright/test` version in
+# `package.json`.
+when:
+  - event: ["push", "manual"]
+    branch: ["main"]
+  - event: ["pull_request"]
+    branch: ["main"]
+engine: microvm
+image: nixos
+virtualisation:
+  docker: true
+steps:
+  - name: "Run browser tests"
+    command: |
+      set -euo pipefail
+
+      docker run --rm --network host \
+        -v "$PWD":/work -w /work \
+        -e CI=true \
+        mcr.microsoft.com/playwright:v1.59.1-noble \
+        bash -c '
+          set -euo pipefail
+          corepack enable
+          pnpm install --frozen-lockfile
+          pnpm run test:nuxt
+          pnpm run test:browser
+        '
diff --git a/.tangled/workflows/test.yml b/.tangled/workflows/test.yml
new file mode 100644
index 0000000..2a850e9
--- /dev/null
+++ b/.tangled/workflows/test.yml
@@ -0,0 +1,37 @@
+# Lint, typecheck and test the repo.
+#
+# Browser-based tests live in `browser.yml`; everything here runs in Node.
+when:
+  - event: ["push", "manual"]
+    branch: ["main"]
+  - event: ["pull_request"]
+    branch: ["main"]
+engine: microvm
+image: nixos
+dependencies:
+  - pnpm
+  - nodejs
+  # `git` and `openssh` back the git-wire and ssh-keypair unit tests, which
+  # shell out to `git-upload-pack`/`git-receive-pack` and `ssh-keygen`.
+  - git
+  - openssh
+environment:
+  PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
+steps:
+  - name: "Install dependencies"
+    command: pnpm install --frozen-lockfile
+
+  - name: "Lint"
+    command: pnpm run lint
+
+  - name: "Typecheck"
+    command: pnpm run test:types
+
+  - name: "Unit tests"
+    command: pnpm run test:unit
+
+  - name: "Unused code and dependencies"
+    command: pnpm run knip
+
+  - name: "Build"
+    command: pnpm run build
-- 
2.51.2