Merge main into the epic: NestJS 11, slug-change rendering — and make CI actually run

.github/workflows/app-deploy-staging.yml

@@ -35,8 +35,11 @@ jobs:
         uses: actions/checkout@v5
         with:
           # The encoder's player packages are consumed from luminary-media-convert/, which is
-          # a submodule rather than a published package. The submodule repository is
-          # public, so the built-in token suffices; no extra credential is needed.
+          # a submodule rather than a published package. Until that repository is
+          # public, the built-in token cannot read it — MEDIA_CONVERT_SUBMODULE_TOKEN
+          # is a fine-grained PAT with read access to it. Once the repository is
+          # public the secret can be deleted; the fallback token then suffices.
+          token: ${{ secrets.MEDIA_CONVERT_SUBMODULE_TOKEN || github.token }}
           submodules: true
 
       - name: Create .env file

.github/workflows/app-unit-tests.yml

@@ -24,8 +24,11 @@ jobs:
         uses: actions/checkout@v5
         with:
           # The encoder's player packages are consumed from luminary-media-convert/, which is
-          # a submodule rather than a published package. The submodule repository is
-          # public, so the built-in token suffices; no extra credential is needed.
+          # a submodule rather than a published package. Until that repository is
+          # public, the built-in token cannot read it — MEDIA_CONVERT_SUBMODULE_TOKEN
+          # is a fine-grained PAT with read access to it. Once the repository is
+          # public the secret can be deleted; the fallback token then suffices.
+          token: ${{ secrets.MEDIA_CONVERT_SUBMODULE_TOKEN || github.token }}
           submodules: true
 
       - name: Setup Node.js

.github/workflows/cms-deploy-staging.yml

@@ -35,8 +35,11 @@ jobs:
         uses: actions/checkout@v5
         with:
           # The encoder's player packages are consumed from luminary-media-convert/, which is
-          # a submodule rather than a published package. The submodule repository is
-          # public, so the built-in token suffices; no extra credential is needed.
+          # a submodule rather than a published package. Until that repository is
+          # public, the built-in token cannot read it — MEDIA_CONVERT_SUBMODULE_TOKEN
+          # is a fine-grained PAT with read access to it. Once the repository is
+          # public the secret can be deleted; the fallback token then suffices.
+          token: ${{ secrets.MEDIA_CONVERT_SUBMODULE_TOKEN || github.token }}
           submodules: true
 
       - name: Create .env file

.github/workflows/cms-unit-tests.yml

@@ -24,8 +24,11 @@ jobs:
         uses: actions/checkout@v5
         with:
           # The encoder's player packages are consumed from luminary-media-convert/, which is
-          # a submodule rather than a published package. The submodule repository is
-          # public, so the built-in token suffices; no extra credential is needed.
+          # a submodule rather than a published package. Until that repository is
+          # public, the built-in token cannot read it — MEDIA_CONVERT_SUBMODULE_TOKEN
+          # is a fine-grained PAT with read access to it. Once the repository is
+          # public the secret can be deleted; the fallback token then suffices.
+          token: ${{ secrets.MEDIA_CONVERT_SUBMODULE_TOKEN || github.token }}
           submodules: true
 
       - name: Setup Node.js

.github/workflows/e2e-local-stack.yml

@@ -36,6 +36,14 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
+        with:
+          # The app imports the encoder's player packages from the submodule. Until
+          # that repository is public, the built-in token cannot read it —
+          # MEDIA_CONVERT_SUBMODULE_TOKEN is a fine-grained PAT with read access to
+          # it. Once the repository is public the secret can be deleted; the
+          # fallback token then suffices.
+          token: ${{ secrets.MEDIA_CONVERT_SUBMODULE_TOKEN || github.token }}
+          submodules: true
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -49,6 +57,13 @@ jobs:
             cms/package-lock.json
             playwright-tests/package-lock.json
 
+      - name: Build the encoder's player libraries
+        # The submodule's packages ship only dist/, which is gitignored — a fresh
+        # checkout has sources and no entry points, and Vite fails with "Failed to
+        # resolve entry for package". Same as the unit-test workflows.
+        run: npm run ci:libs; npm run build:libs;
+        working-directory: luminary-media-convert
+
       - name: Start CouchDB
         run: |
           ./scripts/start-couchdb-in-ci.sh