NPM audit and run tests during CI

.github/workflows/static.yml

@@ -1,7 +1,8 @@
 name: Deploy SvelteKit to GitHub Pages
 
 on:
-  workflow_dispatch: # allows manual trigger
+  push:
+    branches: [main]
 
 permissions:
   contents: read
@@ -21,9 +22,19 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version-file: .nvmrc
+          cache: npm # cache node_modules for faster builds
 
       - name: Install dependencies
-        run: npm i
+        run: npm ci # install dependencies using lock file
+
+      - name: Security audit
+        run: npm audit --audit-level=high # low and moderate vulnerabilities wont fail CI
+
+      - name: Install Playwright browsers for e2e tests
+        run: npx playwright install --with-deps
+
+      - name: Run tests
+        run: npm test
 
       # Build the SvelteKit project
       - name: Build project

README.md

@@ -58,8 +58,10 @@ There is a variety of reusable components in `./src/lib/components/*.svelte`
 
 There are automated tests using Playwright.
 
-- run this the first time, to install Playwright dependencies: `npx playwright install`
-- `npm run test` to run tests
+Don't run local stack (`npm run dev`), the test runner will start a dev server.
+
+- **first time only** install Playwright dependencies: `npx playwright install`
+- `npm run test`
 
 
 ## Production build

playwright.config.ts

@@ -1,12 +1,13 @@
 import { defineConfig } from '@playwright/test';
 
 export default defineConfig({
-    // webServer: {
-    //     command: 'npm run build && npm run preview',
-    //     port: 4173
-    // },
+    webServer: {
+        command: 'npm run build && npm run preview',
+        port: 4173,
+        reuseExistingServer: false
+    },
     use: {
-        baseURL: "http://localhost:5173"
+        baseURL: 'http://localhost:4173'
     },
     testDir: 'e2e'
 });