Add e2e tests, CI, AI crawlability files, and upgrade to Next.js 16 / mongodb 7#3
Conversation
- Add Playwright end-to-end suite covering the home page and the MongoDB connection status badge - Add GitHub Actions CI: lint, build, and e2e against a mongo service container on Node 20.x and 22.x - Add AGENTS.md, EDD.md, .claude/settings.json, and Apache-2.0 LICENSE - Expand README with features, tech stack, architecture diagram, prerequisites, environment variables, project structure, testing, and troubleshooting sections
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![semgrep-code-mongodb[bot]](https://avatars.githubusercontent.com/u/45120?s=60&v=4){kind=small}
|
|
||
| - name: Upload Playwright report | ||
| if: ${{ !cancelled() }} | ||
| uses: actions/upload-artifact@v4 |
There was a problem hiding this comment.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🧼 Fixed in commit f883b7e 🧼
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 |
There was a problem hiding this comment.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🥳 Fixed in commit f883b7e 🥳
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🥳 Fixed in commit f883b7e 🥳
- Upgrade next 15->16, react/react-dom 19.0->19.2, mongodb 6->7, eslint-config-next 16 - Migrate lint to ESLint CLI (next lint removed in Next 16); rewrite eslint.config.mjs to native flat config - Pin Turbopack workspace root in next.config.ts - Convert tailwind plugin require() to ESM import - Update README version references
Resolve Semgrep findings by pinning actions/checkout, actions/setup-node, and actions/upload-artifact to full commit SHAs with version comments.
sis0k0
changed the title
Rename appName from devrel.nextjs.starter to devrel-github-javascript-nextjs to match the devrel-github-<language>-<stack> pattern used across the org's example repos (mean/mern). Updates EDD.md to match.
Use devrel-github-javascript-nextjs-ci so CI telemetry shares the recommended app prefix while remaining distinguishable from production.
2 participants
Summary
Applies the MongoDB Developer AI & Search Crawlability checklist, adds an
end-to-end test suite with CI, and upgrades the template to the latest major
versions of Next.js, React, and the MongoDB driver.
What's included
Dependency upgrades & code migration
next@^16.2.9), React 19.0 → 19.2 (react/react-dom@^19.2.7),MongoDB driver 6 → 7 (
mongodb@^7.4.0), eslint-config-next → 16next lintwas removed in Next 16) andrewrote
eslint.config.mjsto a native flat confignext.config.tsrequire()to an ESM importmongodbv7)Tests & CI
tests/e2e/home.spec.ts,playwright.config.ts):app/page.tsx→db/connection-status.ts→lib/mongodb.ts→ a realping)next devlocally andnext startin CI.github/workflows/ci.yml): lint → build → e2e against amongo:latestservice container, on Node20.xand22.x(max-parallel: 1),uploads the Playwright report as an artifact
package.json: adds@playwright/testandtest/test:e2e/test:e2e:uiscripts.gitignore: ignores Playwright artifactsSecurity hardening (Semgrep)
the Semgrep mutable-action-reference findings:
actions/checkout,actions/setup-node,actions/upload-artifactCrawlability checklist files
Prerequisites, Environment Variables table, Project Structure, Testing, and
Troubleshooting sections
collections) with an example entity for extension
appName(devrel.nextjs.starter) was already set inlib/mongodb.ts.Verification
npm run lint— clean (ESLint CLI, native flat config)npm run build— succeeds on Next 16 (Turbopack), page prerenders staticnpm run test:e2e— 2 passed locally (dev) and in CI mode (next start), against a real MongoDBNotes / follow-ups (GitHub metadata, not in this PR)
These require repo-settings changes rather than file edits:
mongodb,nextjs,react,typescript,tailwindcss,shadcn-ui,vercel,template,fullstackmongodbfrom names inmongodb-developer; renaming is disruptive, so left as-is.