ci: no workflow runs the apps/web unit suite — 292 tests, including every CWE-209 regression test, gate nothing

[groupthinking]

Summary

No CI job executes apps/web's unit test suite. 52 test files / 292 tests never run on any pull request. Among them are every information-disclosure regression test written for #1381 (+10) and #1440 (+4) — tests whose entire purpose is to prove that Stripe keys, OpenAI account state, and SSRF-guard policy stop reaching clients.

They could all be deleted and every required check would stay green.

Verified

Every job that plausibly runs them, on #1381 @ 8e22f203:

Job	What it actually runs	Runs web tests?
test (ci.yml)	PYTHONPATH=src pytest tests/unit/ -v --timeout=120 -k "not integration"	❌ Python only
build (ci.yml)	npm run type-check (continue-on-error: true), npm run lint, npm run build:web	❌ no tests
Generate and Upload Coverage (coverage.yml)	pytest tests/ --cov=src/youtube_extension	❌ Python only
lint-frontend	ESLint	❌
E2E Pipeline Tests (e2e-tests.yml)	npx vitest run tests/e2e/ — one live smoke test against https://uvai.io	❌ different suite, and skipped on #1381

Exhaustive grep across all workflows:

$ grep -rn "vitest\|npm test\|npm run test\|turbo run test" .github/workflows/*.yml
dependency-review.yml:28:   # ...vite/vitest tree (BlueOak-1.0.0...)   ← a comment
e2e-tests.yml:115:          npx vitest run tests/e2e/ --reporter=verbose

Root package.json defines "test": "turbo run test", and no workflow invokes it.

$ find apps/web/src -name "*.test.ts*" | wc -l
52

Consequences

1. Security regression tests are decorative. fix(web): stop leaking upstream and Stripe error details to clients #1381's +10 tests assert that sk_live_****, org-eventrelay-prod, acct_1QLive, cus_live_secret etc. never appear in a response body. fix(web): stop /api/transcribe leaking probe status and key config #1440's +4 assert the same for probe status, key-configuration state, and SSRF guard policy. A refactor that reintroduces any of those leaks passes CI.

2. PR evidence sections cite a check that doesn't cover them. fix(web): stop leaking upstream and Stripe error details to clients #1381's body lists test among the passing checks as evidence for its web tests. That check ran pytest. This is not the author's error — the check name gives no hint of its scope.

3. TypeScript errors don't fail CI either. build runs type-check under continue-on-error: true, so only ESLint and the Next build are actually enforcing.

4. A locally-failing test is invisible rather than tolerated. billing-chat-gating "blocks free tier after daily quota" fails locally (documented in fix(web): stop leaking upstream and Stripe error details to clients #1381, billing-chat-gating free-tier test depends on ambient AI_GATEWAY_API_KEY and passes vacuously in CI #1116, test: make web suite hermetic against ambient AI gateway keys #1230 as a pre-existing ambient-AI-gateway-key issue). It does not fail in CI because CI never runs it. Whatever test: make web suite hermetic against ambient AI gateway keys #1230 fixes, CI would not have noticed either way.

Same defect class as #1436

#1436 documents governance escape paths reporting success on a check that never evaluated the contract. This is the same shape, one layer down: a required check whose green does not mean what its name implies. MERGE_POLICY.md gate 2 lists test as required for every PR; a reader reasonably concludes tests ran.

MERGE_POLICY.md already names this exact failure mode:

A check red on everything has zero signal and actively hides real failures.

The inverse is equally true, and cheaper to miss: a check green on everything, because it never ran the thing under test.

Suggested fix

Add a test-frontend job to ci.yml mirroring lint-frontend:

  test-frontend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: "22"
          cache: "npm"
      - run: npm install --legacy-peer-deps
      - name: Unit tests (apps/web)
        run: cd apps/web && npx vitest run

Two things to decide before it can be required:

• billing-chat-gating will fail on first run unless test: make web suite hermetic against ambient AI gateway keys #1230 lands first, or the job runs with the AI-gateway key unset. Sequencing test: make web suite hermetic against ambient AI gateway keys #1230 ahead of this is probably cleanest.
• Whether to drop continue-on-error: true from the build job's type-check in the same change. Separate call — it may be deliberate.

Acceptance criteria

• A PR that breaks any apps/web unit test fails a required check.
• The job is added to MERGE_POLICY.md gate 2's required list under the correct check-run name.
• Deleting apps/web/src/**/__tests__/** fails CI. (The honest fail-test: if it still passes, the job isn't wired up.)

Provenance

Found while verifying #1440's merge into #1381. I had reported that my new tests "passed in real CI" on the strength of the green test check; checking what that job executes showed it runs pytest. The tests are verified only by local runs — mine and the PR authors'.

[linear-code]

GRV-359

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.