Testing & reliability

A boilerplate is a promise about the future: that the code you build on will not shift under you. These are the mechanisms behind that promise — all of them things you can run yourself.

Both engines, actually

PostgreSQL and SQLite are both first-class, so the whole Go suite runs on both — not a hand-picked subset. Test databases come from one helper (internal/db/dbtest): a throwaway SQLite file by default, a disposable PostgreSQL database per test when the CI matrix asks. A CI guard fails the job if that wiring ever stops reaching the tests.

make test                                      # SQLite
TEST_DB_DRIVER=postgres \
TEST_POSTGRES_DSN=postgres://… go test ./...   # PostgreSQL

The e2e drives the real binary

Playwright does not test a dev server: vite build + go build, then the suite walks the production binary — signup with email verification, login with neutral errors, password reset, invitations (including the invitee whose emailed token never reached the browser), RBAC refusals, cross-tenant 404s, webhook signature and duplicate delivery.

The defaults are tested too

Most deployments never configure Stripe — so the unconfigured path is covered: the app boots, the billing page explains itself, every mutation answers a deliberate 501, and nothing is written. A feature that can be switched off is tested off as well as on.

What CI runs, in order

Cheapest signal first, so a bad workflow fails in two minutes rather than after Playwright:

1. Workflow scanners (zizmor, actionlint, poutine)
2. Dependency audit: go mod verify, govulncheck, Trivy, npm audit
3. golangci-lint (gosec included), eslint, vue-tsc, vitest
4. Backend tests × 2 engines, race detector on
5. Docker image build + Trivy scan, e2e, production build + smoke test

CodeQL adds data-flow analysis for Go and TypeScript on every push. Every action is pinned to a full commit SHA; jobs start from zero permissions.

Current figures

• 15 Go packages green on both engines; ~73 % statement coverage, no package below 59 %
• 37 frontend unit tests, 15 Playwright journeys
• govulncheck and npm audit: zero reachable vulnerabilities