BSL-67: CI/CD pipeline (GitHub Actions)

.env.example

@@ -15,6 +15,14 @@ DATABASE_URL="mongodb://localhost:27017/test-db"
 AUTH_SECRET=
 
 # Google OAuth (create at https://console.cloud.google.com/apis/credentials)
-# Redirect URI: http://localhost:3000/api/auth/callback/google
+# Local redirect URI:      http://localhost:3000/api/auth/callback/google
+# Production redirect URI:  https://<your-vercel-domain>/api/auth/callback/google
 AUTH_GOOGLE_ID=
-AUTH_GOOGLE_SECRET=
+AUTH_GOOGLE_SECRET=
+
+# Resend transactional email (https://resend.com/api-keys)
+RESEND_API_KEY=
+
+# Comma-separated super-admin emails granted elevated access on deploy.
+# Keep real production emails out of version control (set in Vercel only).
+BSL_ADMIN_EMAIL=

.eslintrc.json

@@ -0,0 +1,10 @@
+{
+  "extends": ["next/core-web-vitals", "prettier"],
+  "ignorePatterns": [
+    "node_modules/",
+    ".next/",
+    "generated/",
+    "playwright-report/",
+    "next-env.d.ts"
+  ]
+}

.github/workflows/ci.yml

@@ -0,0 +1,59 @@
+name: CI
+
+# Runs on every pull request targeting main. Configure branch protection on
+# `main` to require the "Lint & Build" check below so failing lint/build blocks
+# merges. (That is the job's `name:`, which is what GitHub shows as the check.)
+on:
+  pull_request:
+    branches: [main]
+
+# Cancel in-progress runs for the same PR when new commits are pushed.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Lint & Build
+    runs-on: ubuntu-latest
+
+    # The gallery pages (/startups, /organizations, /teams) are server
+    # components that query MongoDB during `next build`'s static prerender
+    # step, so the build needs a reachable database. An ephemeral standalone
+    # Mongo is enough — the queries just return empty result sets in CI.
+    services:
+      mongodb:
+        image: mongo:7
+        ports:
+          - 27017:27017
+
+    env:
+      # Build-time placeholders. Real secrets live in Vercel, never in CI.
+      DATABASE_URL: mongodb://localhost:27017/bsl-ci
+      AUTH_SECRET: ci-build-placeholder-secret
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      # react-simple-maps@3 still pins React 18 as a peer, which conflicts with
+      # the project's React 19. --legacy-peer-deps mirrors the local install.
+      - name: Install dependencies
+        run: npm ci --legacy-peer-deps
+
+      # The generated Prisma client is gitignored, so it must be generated
+      # before type-checking and building.
+      - name: Generate Prisma client
+        run: npx prisma generate
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Build
+        run: npm run build

.gitignore

@@ -8,3 +8,4 @@ next-env.d.ts
 *.tsbuildinfo
 tsconfig.tsbuildinfo
 playwright-report/.last-run.json
+.DS_Store

CLAUDE.md

@@ -88,9 +88,9 @@ import { Button } from "@/components/ui/button";
 
 ### Prisma Client Import
 
-The generated Prisma client lives in `generated/prisma/client`. When importing types directly:
+The generated Prisma client is exported from `@prisma/client`. When importing types directly:
 ```typescript
-import { Prisma } from "@/generated/prisma/client";
+import { Prisma } from "@prisma/client";
 ```
 
 ## Environment Variables

app/admin/(authenticated)/access-denied/page.tsx

@@ -7,7 +7,7 @@ export default function AccessDeniedPage() {
       <div className="w-full max-w-sm space-y-8 p-8 text-center">
         <h1 className="text-2xl font-bold text-gray-900">Access Denied</h1>
         <p className="mt-2 text-sm text-gray-500">
-          You don't have permission to view this page.
+          You don&apos;t have permission to view this page.
         </p>
         <button
           onClick={() => signOut({ callbackUrl: "/admin/login" })}

app/api/admin/applications/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { Prisma } from "@/generated/prisma/client";
+import { Prisma } from "@prisma/client";
 import { prisma } from "@/lib/prisma";
 import { auth } from "@/auth";
 import { hasRole } from "@/lib/rbac";