Automated pipeline validation

.github/workflows/ci.yml

@@ -1,5 +1,5 @@
-# Continuous Integration - Linting and Testing
-# Workflow order: Lint → Docker Build → E2E Tests
+# Continuous Integration - Linting, Type-Checking, and Testing
+# Workflow order: Lint → Type Check → API Client Validation → Docker Build → E2E Tests
 
 name: CI
 
@@ -46,7 +46,7 @@ env:
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
-  # Step 1: Fast lint checks (fail fast)
+  # Step 1a: Fast Python lint checks (fail fast)
   lint:
     name: Lint Python
     runs-on: ubuntu-latest
@@ -68,6 +68,7 @@ jobs:
       - name: Run ruff formatter check
         run: ruff format --check .
 
+  # Step 1b: ESLint with innerHTML ban + restricted syntax rules
   lint-js:
     name: Lint JavaScript
     runs-on: ubuntu-latest
@@ -86,7 +87,31 @@ jobs:
       - name: Run ESLint
         run: npx eslint .
 
-  # Step 1b: Validate generated API client is up to date
+  # Step 1c: Strict TypeScript type-checking (catches stale API references)
+  typecheck:
+    name: TypeScript Type Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Install Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Install Node dependencies
+        run: pnpm install
+
+      - name: Run TypeScript type check
+        run: pnpm run typecheck
+
+  # Step 1d: Validate generated API client is up to date
   api-client:
     name: API Client Validation
     runs-on: ubuntu-latest
@@ -133,19 +158,18 @@ jobs:
       - name: Validate OpenAPI spec
         run: pnpm run openapi:validate
 
-  # Step 2: Build Docker image (only if lint passes)
+  # Step 2: Build Docker image (only if all checks pass)
   docker:
     name: Build Docker Image
-    needs: [lint, lint-js, api-client]
+    needs: [lint, lint-js, typecheck, api-client]
     uses: ./.github/workflows/docker.yml
     secrets: inherit
 
-  # Step 3: Run E2E tests (only if Docker build succeeds)
+  # Step 3: Run E2E tests with Desktop + Mobile viewports
   test-e2e:
     name: E2E Tests
     runs-on: ubuntu-latest
     needs: [docker]
-    # Only run E2E if we have access to pull the image (not on forks)
     if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
 
     steps:
@@ -166,7 +190,6 @@ jobs:
       - name: Determine image tag to use
         id: image
         run: |
-          # For PRs, use pr-XXX tag (convenient); sha-XXX also available for stability
           REPO="${{ steps.repo.outputs.name }}"
           if [ "${{ github.event_name }}" == "pull_request" ]; then
             echo "tag=ghcr.io/${REPO}:pr-${{ github.event.pull_request.number }}" >> "$GITHUB_OUTPUT"
@@ -200,15 +223,15 @@ jobs:
           docker logs pocket-tts
           exit 1
 
-      - name: Run Playwright tests in container
+      - name: Run Playwright tests (Desktop + Mobile)
         run: |
           docker run --rm \
             --network host \
             -v $(pwd):/work \
             -w /work \
             -e CI=true \
             mcr.microsoft.com/playwright:v1.58.2-noble \
-            /bin/bash -c "npm install -D @playwright/test && npx playwright test"
+            /bin/bash -c "npm install -D @playwright/test && npx playwright test --project=chromium --project=mobile-chrome --project=mobile-safari"
 
       - name: Check for test reports
         if: always()