Introduce CI quality pipeline, E2E harness, Supabase schema reconciliation, and robust generation/profile flows

[Armand9999]

Motivation

• Harden the application with explicit environment docs, deterministic date handling, and stricter validation for profiles, generated plans, and passwords.
• Add deterministic end-to-end coverage (including an authenticated protected-flow harness and mocked-AI mode) so generation and auth journeys can be tested in CI without calling external models.
• Reconcile and harden the Supabase schema to preserve existing tables, enforce constraints, enable safe Row-Level Security, and provide an atomic save_profile_with_tde function for server-side profile/TDEE writes.
• Improve runtime safety and developer DX by typing Supabase clients, centralizing date utilities, and adding typed database contracts used across server/middleware/browser boundaries.

Description

• Project & CI: add .env.example, a GitHub quality workflow, playwright.config.ts, Playwright test suites, playwright setup, and package script changes (lint, typecheck, test, test:e2e, check, ci), plus .gitignore updates for test artifacts.
• Supabase & DB: add supabase config, a reconciliation migration and preflight SQL, a seed marker, and a generated TypeScript app/lib/database.types.ts contract; migrate generation persistence to non-destructive upsert and add the save_profile_with_tde RPC used by profile actions.
• Validation, domain & generation: introduce app/lib/date.ts (local date keys and week ranges), app/lib/generated-plans.ts (strict Zod schemas + parsing), profile and auth schemas (profile.ts, profile-options.ts, auth.ts), and E2E AI fixtures for deterministic mocked generation.
• API / server code: refactor TDEE calculation to typed input (app/lib/tde.ts), implement typed Supabase helpers (utils/supabase/{client,server,middleware}.ts) with cookie handling and SSR typing, improve auth confirm callback and add password recovery/reset flows and pages, and wire generation actions to OpenAI with schema validation and mock-mode fallback (workout-generator.ts, meal-plan action).
• UI & plumbing: add password recovery and reset pages, profile setup form improvements, meal-plan and workout UI to use local date keys, replace raw <img> with next/image in NavBar, remove Google font dependency and fall back to system fonts, and minor fixes for WeeklyProgress and client-database date handling.
• Tooling: add runtime/CI lint ignore, update eslint.config.mjs, add test tsconfig.test.json, and include a suite of node:test unit/integration tests covering schemas, date logic, TDEE, generated-plan validation, migration contract, and various contracts used by the app.

Testing

• New unit and integration tests were added under tests/ including tde.test.ts, profile-schema.test.ts, generated-plans.test.ts, date.test.ts, auth-schemas.test.ts, database-migration.test.ts, supabase-client-contract.test.ts, password-recovery.test.ts, and an e2e-harness.test.ts contract; these tests are exercised by npm test as part of the check gate.
• Playwright suites were added for public authentication journeys, authenticated protected flows, and mocked-AI generation; they run via npm run test:e2e and are wired into the CI workflow to run on push/PRs.
• The repository check gate (npm run check), the build (npm run build), and the Playwright E2E suite (npm run test:e2e) are integrated into the .github/workflows/quality.yml CI job to ensure linting, type checks, unit tests, and E2E tests run in CI.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
fitness-app	Ready	Preview, Comment	Jun 17, 2026 10:39pm

[chatgpt-codex-connector]

💡 Codex Review

fitness-app/.env.example

Line 16 in db00d20

E2E_MOCK_AI=1

Leave AI mocking disabled by default

Because the workout and meal-plan generators use isE2EAIMockEnabled() and that helper only checks process.env.E2E_MOCK_AI === '1', anyone following the README's cp .env.example .env.local setup will run the app with canned E2E plans instead of OpenAI-backed generation, even after adding a real OpenAI key. Keep this unset/commented in the example, or gate the mock behind a test-only environment check, so local/staging deployments do not accidentally serve deterministic test fixtures.

---

fitness-app/.github/workflows/quality.yml

Lines 13 to 14 in db00d20

	NEXT_PUBLIC_SUPABASE_URL: https://example.supabase.co
	NEXT_PUBLIC_SUPABASE_ANON_KEY: test-anon-key

Point authenticated E2E at the configured Supabase project

When E2E_AUTH_EMAIL and E2E_AUTH_PASSWORD secrets are present, playwright.config.ts enables the authenticated projects, but this workflow still starts the app against https://example.supabase.co with a fake anon key. In that configured-CI scenario the dedicated test user's credentials cannot authenticate against the intended Supabase project, so the protected-flow tests fail instead of exercising the real test backend; use secrets/vars for the Supabase URL and anon key or keep the authenticated projects disabled unless all required Supabase settings are configured.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".