@decocms/blocks-cli 7.38.0 → 7.39.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks-cli",
-  "version": "7.38.0",
+  "version": "7.39.0",
   "type": "module",
   "description": "Deco codegen (generate-blocks, generate-schema, generate-invoke) and Fresh-to-TanStack migration tooling",
   "repository": {
@@ -31,7 +31,7 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.38.0",
+    "@decocms/blocks": "7.39.0",
     "ts-morph": "^27.0.0",
     "tsx": "^4.22.5"
   },

package/scripts/migrate/phase-scaffold.ts

@@ -2,7 +2,11 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import type { MigrationContext } from "./types";
 import { log, logPhase } from "./types";
-import { CANONICAL_BUN_VERSION, generatePackageJson } from "./templates/package-json";
+import {
+  CANONICAL_BUN_VERSION,
+  CANONICAL_NODE_VERSION,
+  generatePackageJson,
+} from "./templates/package-json";
 import { generateLockfileCheckYml } from "./templates/lockfile-check-yml";
 import { generateTsconfig } from "./templates/tsconfig";
 import { generateViteConfig } from "./templates/vite-config";
@@ -21,6 +25,10 @@ import { generateCacheConfig } from "./templates/cache-config";
 import { generateSdkFiles } from "./templates/sdk-gen";
 import { generateMigrationPolicyPointerRule } from "./templates/cursor-rules";
 import { generatePerfFiles } from "./templates/perf-yml";
+import { generateCiFiles } from "./templates/ci-yml";
+import { generateMainPushGuardYml } from "./templates/main-push-guard-yml";
+import { generatePlaywrightFiles } from "./templates/playwright-yml";
+import { generateReactDoctorYml } from "./templates/react-doctor-yml";
 // `lib-utils` is imported lazily — see end of phase-cleanup. Eager
 // generation of all 11 shims left every site with dead code that had
 // to be cleaned up by hand.
@@ -93,6 +101,22 @@ export function scaffold(ctx: MigrationContext): void {
   // (PR vs main), and posts a comparison comment. Gate = CLS + TBT only.
   writeMultiFile(ctx, generatePerfFiles(ctx.siteName));
 
+  // Per-PR quality pipeline (ci.yml) + its no-suppressions gate. BLOCKS on
+  // generate + build; the migration-cleanliness gates (no-suppressions,
+  // typecheck, format, knip) ship advisory so day-one CI is green. Node pinned
+  // in lockstep with the perf/playwright workflows.
+  writeMultiFile(ctx, generateCiFiles(CANONICAL_NODE_VERSION, CANONICAL_BUN_VERSION));
+
+  // Branch-protection surrogate: fails visibly if a commit reaches main
+  // without a PR (never blocks the push itself).
+  writeFile(ctx, ".github/workflows/main-push-guard.yml", generateMainPushGuardYml());
+
+  // Functional E2E harness (chromium + webkit) + self-contained config/smoke.
+  writeMultiFile(ctx, generatePlaywrightFiles(CANONICAL_BUN_VERSION));
+
+  // Advisory React lint (react-doctor): comments on PRs, never fails.
+  writeFile(ctx, ".github/workflows/react-doctor.yml", generateReactDoctorYml());
+
   // Server entry files (server.ts, worker-entry.ts, router.tsx, runtime.ts, context.ts)
   writeMultiFile(ctx, generateServerEntry(ctx));
 

package/scripts/migrate/phase-verify.ts

@@ -21,6 +21,12 @@ const REQUIRED_FILES = [
   // Workers Builds (D6.3) -- configured in the CF dashboard, not via
   // GitHub workflow files in the site repo.
   ".github/workflows/lockfile-check.yml",
+  ".github/workflows/ci.yml",
+  ".github/workflows/main-push-guard.yml",
+  ".github/workflows/playwright.yml",
+  ".github/workflows/react-doctor.yml",
+  "tools/gates/no-suppressions.sh",
+  "playwright.config.ts",
   "knip.config.ts",
   ".prettierrc",
   "src/server.ts",

package/scripts/migrate/templates/ci-workflows.test.ts

@@ -0,0 +1,108 @@
+import { describe, expect, it } from "vitest";
+import { generateCiFiles } from "./ci-yml";
+import { generateMainPushGuardYml } from "./main-push-guard-yml";
+import { generatePlaywrightFiles } from "./playwright-yml";
+import { generateReactDoctorYml } from "./react-doctor-yml";
+
+describe("generateCiFiles", () => {
+  const files = generateCiFiles("22.15.0", "1.3.5");
+  const ci = files[".github/workflows/ci.yml"];
+
+  it("emits the workflow plus the no-suppressions gate + allowlist", () => {
+    expect(Object.keys(files).sort()).toEqual([
+      ".github/workflows/ci.yml",
+      "tools/gates/no-suppressions.sh",
+      "tools/gates/suppressions-allowlist.txt",
+    ]);
+  });
+
+  it("pins node + bun and installs frozen", () => {
+    expect(ci).toContain("name: CI");
+    expect(ci).toContain('NODE_VERSION: "22.15.0"');
+    expect(ci).toContain('BUN_VERSION: "1.3.5"');
+    expect(ci).toContain("bun install --frozen-lockfile");
+  });
+
+  it("blocks on generate + build, keeps cleanliness gates advisory", () => {
+    // generate + build have NO continue-on-error
+    expect(ci).toMatch(/Generate artifacts[\s\S]*?run: bun run generate && bun run generate:routes/);
+    expect(ci).toMatch(/Build \(vite\)\n\s+run: bun run build\n/);
+    // the four cleanliness gates are advisory
+    for (const advisory of ["Typecheck", "Format check", "Knip", "no new suppression"]) {
+      const stepIdx = ci.indexOf(advisory);
+      expect(stepIdx, `${advisory} step missing`).toBeGreaterThan(-1);
+      // a continue-on-error appears within the step block
+      expect(ci.slice(stepIdx, stepIdx + 200)).toContain("continue-on-error: true");
+    }
+  });
+
+  it("strips a bun@ prefix from the version", () => {
+    const f = generateCiFiles("22.15.0", "bun@1.3.5");
+    expect(f[".github/workflows/ci.yml"]).toContain('BUN_VERSION: "1.3.5"');
+  });
+
+  it("is de-projectized — no colombo migration-debt refs", () => {
+    const blob = Object.values(files).join("\n");
+    expect(blob).not.toMatch(/oficina/i);
+    expect(blob).not.toMatch(/#7[89]|#81/); // issues #78/#79/#81
+    expect(blob).not.toMatch(/AGENTS\.md/);
+  });
+
+  it("ships an empty allowlist (only comments)", () => {
+    const allow = files["tools/gates/suppressions-allowlist.txt"];
+    const entries = allow.split("\n").filter((l) => l.trim() && !l.trim().startsWith("#"));
+    expect(entries).toEqual([]);
+  });
+});
+
+describe("generateMainPushGuardYml", () => {
+  const yml = generateMainPushGuardYml();
+  it("guards main pushes via the commits/{sha}/pulls API", () => {
+    expect(yml).toContain("name: main-push-guard");
+    expect(yml).toMatch(/on:\s*\n\s*push:\s*\n\s*branches: \[main\]/);
+    expect(yml).toContain("commits/${SHA}/pulls");
+    expect(yml).toContain("exit 1");
+  });
+});
+
+describe("generatePlaywrightFiles", () => {
+  const files = generatePlaywrightFiles("1.3.5");
+
+  it("emits the workflow, a self-contained config, and a smoke spec", () => {
+    expect(Object.keys(files).sort()).toEqual([
+      ".github/workflows/playwright.yml",
+      "playwright.config.ts",
+      "tests/e2e/smoke.spec.ts",
+    ]);
+  });
+
+  it("installs chromium + webkit and pins bun", () => {
+    const wf = files[".github/workflows/playwright.yml"];
+    expect(wf).toContain('bun-version: "1.3.5"');
+    expect(wf).toContain("playwright install --with-deps chromium webkit");
+    expect(wf).toContain("bun run test:e2e");
+  });
+
+  it("config is self-contained (no support-helper imports) and targets tests/e2e", () => {
+    const cfg = files["playwright.config.ts"];
+    expect(cfg).toContain('testDir: "./tests/e2e"');
+    expect(cfg).not.toContain("./tests/support");
+    expect(cfg).toContain("webkit");
+  });
+
+  it("smoke needs no app boot or network (uses setContent)", () => {
+    const spec = files["tests/e2e/smoke.spec.ts"];
+    expect(spec).toContain("page.setContent");
+    expect(spec).not.toContain("await page.goto"); // no real navigation (comment may mention page.goto)
+  });
+});
+
+describe("generateReactDoctorYml", () => {
+  const yml = generateReactDoctorYml();
+  it("runs react-doctor advisory (no uncommented blocking)", () => {
+    expect(yml).toContain("name: React Doctor");
+    expect(yml).toContain("millionco/react-doctor@v2");
+    expect(yml).toContain("fetch-depth: 0");
+    expect(yml).not.toMatch(/^\s*blocking: error/m);
+  });
+});

package/scripts/migrate/templates/ci-yml.ts

@@ -0,0 +1,182 @@
+/**
+ * Scaffolds the per-PR quality pipeline and its companion gate script:
+ *   .github/workflows/ci.yml                 — GitHub Actions workflow
+ *   tools/gates/no-suppressions.sh           — bans NEW type suppressions + preact
+ *   tools/gates/suppressions-allowlist.txt   — grandfathered offenders (seeded empty)
+ *
+ * Design rationale:
+ *   - A freshly migrated site carries inherited debt (leftover
+ *     @ts-expect-error, not-yet-prettier-clean files, unused exports). So the
+ *     only BLOCKING gates are the ones a site MUST pass to run at all:
+ *     `generate` (CMS + route artifacts) and `build` (vite). Everything that
+ *     depends on migration cleanliness — no-suppressions, typecheck,
+ *     format:check, knip — ships ADVISORY (`continue-on-error: true`) so day-one
+ *     CI is green. Each carries a comment on how to promote it to blocking as
+ *     the debt zeroes out.
+ *   - The scripts the steps call (`generate`, `generate:routes`, `typecheck`,
+ *     `format:check`, `knip`) are all defined in the scaffolded package.json.
+ *
+ * @param nodeVersion  Node version for setup-node (lockstep with package.json engines).
+ * @param bunVersion   Bun version for setup-bun (= CANONICAL_BUN_VERSION).
+ */
+export function generateCiFiles(nodeVersion: string, bunVersion: string): Record<string, string> {
+  const bun = bunVersion.replace(/^bun@/, "");
+  return {
+    ".github/workflows/ci.yml": generateCiYml(nodeVersion, bun),
+    "tools/gates/no-suppressions.sh": NO_SUPPRESSIONS_SH,
+    "tools/gates/suppressions-allowlist.txt": SUPPRESSIONS_ALLOWLIST,
+  };
+}
+
+function generateCiYml(nodeVersion: string, bunVersion: string): string {
+  return `name: CI
+
+# Per-PR quality pipeline. No auto-merge: it only informs the human review.
+#
+# BLOCKS (the site must run): generate (CMS + routes), build.
+# ADVISORY (continue-on-error — inherited migration debt varies per site):
+# no-suppressions, typecheck, format:check, knip. Promote each to blocking by
+# removing its \`continue-on-error\` once that debt is zero.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-\${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  NODE_VERSION: "${nodeVersion}"
+  BUN_VERSION: "${bunVersion}"
+
+jobs:
+  gates:
+    name: gates (no-suppressions, generate, typecheck, format, knip, build)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: \${{ env.NODE_VERSION }}
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: \${{ env.BUN_VERSION }}
+
+      - name: bun install --frozen-lockfile
+        run: bun install --frozen-lockfile
+
+      # ADVISORY — a fresh migration ships inherited suppressions. Seed the
+      # allowlist with the current offenders, then remove \`continue-on-error\`:
+      #   git grep -nE '@ts-expect-error|@ts-ignore' -- src/ tools/ \\
+      #     > tools/gates/suppressions-allowlist.txt
+      - name: Gate — no new suppression + zero preact (advisory)
+        run: bash tools/gates/no-suppressions.sh
+        continue-on-error: true
+
+      # BLOCKS — CMS artifacts + route tree (the build depends on these). knip
+      # also needs routeTree.gen.ts (src/router.tsx imports it).
+      - name: Generate artifacts (CMS + routes)
+        run: bun run generate && bun run generate:routes
+
+      # ADVISORY — flip to blocking once typecheck is clean.
+      - name: Typecheck (advisory)
+        run: bun run typecheck
+        continue-on-error: true
+
+      # ADVISORY — flip to blocking after a repo-wide \`bun run format\` pass.
+      - name: Format check (advisory)
+        run: bun run format:check
+        continue-on-error: true
+
+      # ADVISORY — dead code / orphan deps.
+      - name: Knip (advisory)
+        run: bun run knip
+        continue-on-error: true
+
+      # BLOCKS — the site must compile (vite build does NOT typecheck).
+      - name: Build (vite)
+        run: bun run build
+`;
+}
+
+const NO_SUPPRESSIONS_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+# Gate: NO new type suppression + zero preact import.
+#
+# A migration leaves behind some @ts-expect-error/@ts-ignore. This gate keeps
+# that debt from GROWING: existing suppressions are grandfathered in the
+# allowlist (tools/gates/suppressions-allowlist.txt); any suppression outside it
+# fails the PR. As the type debt zeroes out, remove entries from the allowlist —
+# it only shrinks, never grows.
+#
+# Allowlist format: "path/file.ts:123" (the exact path:line from \`git grep -n\`).
+# Blank lines and "#" are ignored. If you touched a file and an existing
+# suppression's line number moved, update its entry — do not add a new one.
+#
+# Usage: bash tools/gates/no-suppressions.sh
+
+ROOT_DIR="\$(cd "\$(dirname "\${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "\$ROOT_DIR"
+
+ALLOWLIST="tools/gates/suppressions-allowlist.txt"
+SELF_PATH="tools/gates/no-suppressions.sh"
+EXIT_CODE=0
+
+SCAN_PATHS=(-- 'src/' 'tools/' ":(exclude)\${SELF_PATH}" ":(exclude)\${ALLOWLIST}")
+SUPPRESSION_PATTERN='@ts-expect-error|@ts-ignore'
+
+echo "== gate: no new type suppression (\${SUPPRESSION_PATTERN}) =="
+RAW_MATCHES="\$(git grep -nE "\${SUPPRESSION_PATTERN}" "\${SCAN_PATHS[@]}" 2>/dev/null || true)"
+
+if [ -n "\$RAW_MATCHES" ]; then
+  VIOLATIONS=""
+  while IFS= read -r match; do
+    [ -z "\$match" ] && continue
+    path_line="\$(echo "\$match" | cut -d: -f1,2)"
+    if [ -f "\$ALLOWLIST" ] && grep -qxF "\$path_line" "\$ALLOWLIST"; then
+      continue
+    fi
+    VIOLATIONS="\${VIOLATIONS}\${match}"\$'\\n'
+  done <<<"\$RAW_MATCHES"
+
+  if [ -n "\$VIOLATIONS" ]; then
+    echo "FAILED: type suppression outside the allowlist:"
+    echo "\$VIOLATIONS"
+    echo "Fix the type at the source instead of suppressing. If an existing line"
+    echo "only changed number, update its allowlist entry (do not create a new one)."
+    EXIT_CODE=1
+  fi
+fi
+
+echo "== gate: zero preact import =="
+# Matches REAL import specifiers ("preact", "preact/hooks", "@preact/signals"…),
+# not the bare word "preact". Requires straight quotes around the specifier.
+PREACT_IMPORT_PATTERN='["'"'"'](@preact/[a-zA-Z0-9_-]+|preact(/[a-zA-Z0-9_-]+)*)["'"'"']'
+PREACT_MATCHES="\$(git grep -nE "\${PREACT_IMPORT_PATTERN}" "\${SCAN_PATHS[@]}" 2>/dev/null || true)"
+if [ -n "\$PREACT_MATCHES" ]; then
+  echo "FAILED: preact import found (this stack is React, not Preact):"
+  echo "\$PREACT_MATCHES"
+  EXIT_CODE=1
+fi
+
+if [ "\$EXIT_CODE" -eq 0 ]; then
+  echo "OK: no new suppression, no preact import."
+fi
+
+exit "\$EXIT_CODE"
+`;
+
+const SUPPRESSIONS_ALLOWLIST = `# Grandfathered type suppressions (path:line from \`git grep -n\`).
+# Seed this with the migration's leftover offenders to flip the CI
+# no-suppressions gate from advisory to blocking:
+#   git grep -nE '@ts-expect-error|@ts-ignore' -- src/ tools/ >> tools/gates/suppressions-allowlist.txt
+# This list only shrinks — never add a new entry for new code.
+`;

package/scripts/migrate/templates/main-push-guard-yml.ts

@@ -0,0 +1,45 @@
+/**
+ * Scaffolds `.github/workflows/main-push-guard.yml` — a branch-protection
+ * surrogate. It does NOT block the push (real branch protection would, before
+ * the fact); it fails visibly in the Actions history when a commit reaches main
+ * without going through a PR (the "never commit straight to main" convention).
+ *
+ * Heuristic: GET /repos/{owner}/{repo}/commits/{sha}/pulls returns the PRs
+ * associated with a commit (including the merge/squash/rebase GitHub records on
+ * main when a PR merges). Empty list = the commit did not come from a PR.
+ *
+ * Fully generic — no per-site parameters.
+ */
+export function generateMainPushGuardYml(): string {
+  return `name: main-push-guard
+
+# Branch-protection surrogate: detects a commit that reaches main WITHOUT a PR.
+# Does not block the push — only fails visibly in the Actions history when the
+# "never commit straight to main" convention is broken.
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  guard:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check that the commit on main came from a merged PR
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+          REPO: \${{ github.repository }}
+          SHA: \${{ github.sha }}
+        run: |
+          count="\$(gh api "repos/\${REPO}/commits/\${SHA}/pulls" --jq 'length')"
+          if [ "\$count" -eq 0 ]; then
+            echo "::error::commit \${SHA} reached main with no associated PR (direct push). Convention: one issue = one PR, never commit straight to main."
+            exit 1
+          fi
+          echo "OK: commit \${SHA} associated with \${count} PR(s)."
+`;
+}

package/scripts/migrate/templates/package-json.ts

@@ -12,6 +12,14 @@ import type { MigrationContext } from "../types";
  */
 export const CANONICAL_BUN_VERSION = "1.3.5";
 
+/**
+ * Fleet-wide canonical Node version. Used by the scaffolded CI / Playwright
+ * workflows' setup-node step (kept in lockstep with the perf workflow's pinned
+ * node-version). 22.15 is the floor for @cloudflare/vite-plugin's
+ * module.registerHooks.
+ */
+export const CANONICAL_NODE_VERSION = "22.15.0";
+
 /**
  * Get the latest published version of an npm package.
  * Falls back to the provided default if the lookup fails.
@@ -145,6 +153,7 @@ export function generatePackageJson(ctx: MigrationContext): string {
       format: 'prettier --write "src/**/*.{ts,tsx}"',
       "format:check": 'prettier --check "src/**/*.{ts,tsx}"',
       knip: "knip",
+      "test:e2e": "playwright test",
       clean:
         "rm -rf node_modules .cache dist .wrangler/state node_modules/.vite && bun install",
       "tailwind:lint":
@@ -174,6 +183,7 @@ export function generatePackageJson(ctx: MigrationContext): string {
     devDependencies: {
       "@cloudflare/vite-plugin": "^1.27.0",
       "@decocms/blocks-cli": `^${frameworkVersion}`,
+      "@playwright/test": "^1.62.1",
       // CLI build of src/styles/app.css — used by the migration's own
       // css-compile-check.ts (phase-compile) and by `tailwind:lint`, so a
       // dropped custom theme token fails migration/CI instead of shipping

package/scripts/migrate/templates/playwright-yml.ts

@@ -0,0 +1,127 @@
+/**
+ * Scaffolds the E2E harness and its config/smoke companions:
+ *   .github/workflows/playwright.yml  — GitHub Actions workflow (chromium + webkit)
+ *   playwright.config.ts              — self-contained config (no support helpers)
+ *   tests/e2e/smoke.spec.ts           — harness smoke, no app boot, no network
+ *
+ * Design rationale:
+ *   - The smoke proves the Playwright harness runs in CI (chromium + webkit)
+ *     without the app booting or hitting the network — it renders inline HTML
+ *     via page.setContent. Real storefront specs (page.goto("/")) need a VCR
+ *     layer so CI does not hit the commerce API; add a `webServer` block to the
+ *     config and specs that navigate the app once that harness exists.
+ *   - webkit is included because the storefront audience is majority iOS Safari.
+ *   - The workflow needs `@playwright/test` + the `test:e2e` script, both in the
+ *     scaffolded package.json.
+ *
+ * @param bunVersion  Bun version for setup-bun (= CANONICAL_BUN_VERSION).
+ */
+export function generatePlaywrightFiles(bunVersion: string): Record<string, string> {
+  const bun = bunVersion.replace(/^bun@/, "");
+  return {
+    ".github/workflows/playwright.yml": generatePlaywrightYml(bun),
+    "playwright.config.ts": PLAYWRIGHT_CONFIG,
+    "tests/e2e/smoke.spec.ts": SMOKE_SPEC,
+  };
+}
+
+function generatePlaywrightYml(bunVersion: string): string {
+  return `name: Playwright
+
+# Functional E2E (chromium + webkit). Today only a harness smoke that renders
+# inline HTML — no app boot, no network — so it runs on a plain ubuntu runner.
+# When specs navigate the real app (via VCR), pin the container and add a
+# webServer block to playwright.config.ts.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: playwright-\${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  e2e:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "${bunVersion}"
+
+      - name: bun install --frozen-lockfile
+        run: bun install --frozen-lockfile
+
+      - name: Install browsers (chromium + webkit)
+        run: bunx playwright install --with-deps chromium webkit
+
+      - name: E2E
+        run: bun run test:e2e
+
+      - name: Upload HTML report
+        if: \${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: playwright-report/
+          retention-days: 14
+`;
+}
+
+const PLAYWRIGHT_CONFIG = `/**
+ * Playwright config — E2E base.
+ *
+ * Today only a harness smoke (tests/e2e/smoke.spec.ts) that renders inline HTML,
+ * proving the harness runs in CI without the app booting or hitting the network.
+ * Real app E2E (page.goto("/")) needs a VCR layer so CI does not call the
+ * commerce API — add a \`webServer\` block (e.g. { command: "bun run build && bun
+ * run preview", url: "http://localhost:4173" }) and the navigating specs then.
+ *
+ * chromium + webkit (webkit because the storefront audience is majority iOS
+ * Safari). 1 worker, 0 retries on purpose: retry masks flake instead of exposing it.
+ */
+
+import { defineConfig, devices } from "@playwright/test";
+
+export default defineConfig({
+  testDir: "./tests/e2e",
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: 0,
+  workers: 1,
+  reporter: [["html", { open: "never" }], ["list"]],
+  use: {
+    trace: "retain-on-failure",
+    screenshot: "only-on-failure",
+  },
+  projects: [
+    { name: "chromium", use: { ...devices["Desktop Chrome"] } },
+    { name: "webkit", use: { ...devices["Desktop Safari"] } },
+  ],
+});
+`;
+
+const SMOKE_SPEC = `/**
+ * Smoke E2E — proves the Playwright harness runs (chromium + webkit) in CI
+ * without the app booting or hitting the network. Does not test the real app;
+ * the storefront E2E (page.goto("/")) comes with the VCR + cassettes harness.
+ */
+
+import { expect, test } from "@playwright/test";
+
+test("harness renders inline content", async ({ page }) => {
+  await page.setContent(
+    '<title>e2e smoke</title><h1>ok</h1><div data-testid="marker">ready</div>',
+  );
+
+  await expect(page).toHaveTitle("e2e smoke");
+  await expect(page.getByRole("heading", { name: "ok" })).toBeVisible();
+  await expect(page.getByTestId("marker")).toHaveText("ready");
+});
+`;

package/scripts/migrate/templates/react-doctor-yml.ts

@@ -0,0 +1,46 @@
+/**
+ * Scaffolds `.github/workflows/react-doctor.yml` — flags React
+ * security/perf/correctness/a11y/bundle-size/architecture issues on PRs.
+ *
+ * Advisory by construction (the action's default: comments, never fails the
+ * build). Separate workflow from ci.yml on purpose — zero coupling with the
+ * blocking gates. `fetch-depth: 0` gives the merge-base so it reports only what
+ * the PR introduces.
+ *
+ * Fully generic — no per-site parameters. Docs: https://www.react.doctor/ci
+ */
+export function generateReactDoctorYml(): string {
+  return `name: React Doctor
+
+# Flags React security/perf/correctness/a11y/bundle-size/architecture issues.
+# Advisory by construction (comments, never fails the check). To make it a hard
+# gate, add \`with: { blocking: error }\` to the action step below.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+  statuses: write
+
+concurrency:
+  group: react-doctor-\${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  react-doctor:
+    runs-on: ubuntu-latest
+    steps:
+      # fetch-depth: 0 gives the merge-base so it reports only PR-introduced findings.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: millionco/react-doctor@v2
+`;
+}