chore: normalize build, Sentry, and CI configuration

Applies the approved fleet normalization proposals for this site:

- preload-recovery-everywhere: install src/utils/preloadRecovery.ts and
  call it from main.ts before createApp
- sentry-release-and-environment: release/environment in Sentry.init,
  VITE_SENTRY_RELEASE wired through the deploy build
- shared-sentry-ignore-errors: the canonical five-entry ignoreErrors array
- stop-publishing-sourcemaps: build.sourcemap 'hidden', and the deploy
  strips .map files after the Sentry upload and before wrangler deploy
- ci-lint-and-unit-parity: CI lint job runs the aggregate pnpm run lint
  (eslint, stylelint, oxlint, knip) and unit tests run with --run
- workflow-hygiene-block: contents:read on CI, deploy concurrency never
  cancels in flight, submodules checkout dropped, dead ci:build removed
- vue-devtools-serve-only: devtools gated on command === 'serve' and
  launchEditor read from VITE_LAUNCH_EDITOR
- manifest-installability: theme_color reconciled with index.html, icon
  entries that misreport apple-touch-icon.png's size removed
- tsconfig-node-target-alignment: extend @tsconfig/node26, drop the
  nightwatch include, give tsconfig.vitest.json a real lib array

Also harmonizes registerServiceWorker() with the fleet template by
composing the worker URL and scope from import.meta.env.BASE_URL.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: RISCfuture

.github/workflows/ci.yml

@@ -1,6 +1,3 @@
-# This workflow will do a clean install of node dependencies, cache/restore them, build the source code and run tests across different versions of node
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
-
 name: CI
 
 on:
@@ -9,14 +6,19 @@ on:
   pull_request:
     branches: [master]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   unit:
     name: Unit Tests
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-        with:
-          submodules: true
       - name: Set up pnpm
         uses: pnpm/action-setup@v6
       - name: Set up Node.js
@@ -27,14 +29,13 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
       - name: Run unit tests
-        run: pnpm run test:unit
+        run: pnpm run test:unit -- --run
+
   e2e:
     name: E2E Tests
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-        with:
-          submodules: true
       - name: Set up pnpm
         uses: pnpm/action-setup@v6
       - name: Set up Node.js
@@ -44,17 +45,22 @@ jobs:
           node-version-file: .nvmrc
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
-      - name: Install Playwright browsers
-        run: pnpm exec playwright install --with-deps
+      - name: Install Playwright system dependencies
+        run: pnpm exec playwright install-deps
+        timeout-minutes: 3
+      - name: Install Playwright Browsers
+        run: pnpm exec playwright install
+        timeout-minutes: 3
+      - name: Build project
+        run: pnpm run build
       - name: Run E2E tests
         run: pnpm run test:e2e
+
   lint:
     name: Linters
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-        with:
-          submodules: true
       - name: Set up pnpm
         uses: pnpm/action-setup@v6
       - name: Set up Node.js
@@ -64,9 +70,7 @@ jobs:
           node-version-file: .nvmrc
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
-      - name: Run ESLint
-        run: pnpm run lint:eslint
-      - name: Run Stylelint
-        run: pnpm run lint:stylelint
+      - name: Run linters
+        run: pnpm run lint
       - name: Type check
         run: pnpm run type-check

.github/workflows/deploy.yml

@@ -13,18 +13,14 @@ on:
 permissions:
   contents: read
 
-# Allow one concurrent deployment
+# Allow one concurrent deployment, and never cancel one in flight
 concurrency:
   group: deploy
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 jobs:
   deploy:
-    name: Build and Deploy
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
-    environment:
-      name: production
-      url: https://icrashedmyplane.com/
+    if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -44,10 +40,8 @@ jobs:
         run: pnpm run build
         env:
           VITE_SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-      - name: Deploy to Cloudflare Workers
-        run: pnpm exec wrangler deploy
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          VITE_SENTRY_RELEASE: ${{ github.sha }}
+      # Sourcemaps must reach Sentry BEFORE they are deleted. Do not reorder.
       - name: Create Sentry release
         uses: getsentry/action-release@v3
         env:
@@ -58,3 +52,10 @@ jobs:
           environment: production
           release: ${{ github.sha }}
           sourcemaps: './dist'
+      # Sourcemaps must not reach the public. Do not reorder.
+      - name: Strip source maps from the published assets
+        run: find dist -name '*.map' -delete
+      - name: Deploy to Cloudflare Workers
+        run: pnpm exec wrangler deploy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

package.json

@@ -9,7 +9,6 @@
   "scripts": {
     "build": "run-p type-check \"build-only {@}\" --",
     "build-only": "vite build",
-    "ci:build": "run-p type-check \"build-only {@}\" --",
     "ci:unit": "vitest --run",
     "dev": "vite",
     "doc": "npx typedoc --out docs src",
@@ -41,7 +40,7 @@
     "@pinia/testing": "^1.0.3",
     "@playwright/test": "^1.61.1",
     "@testing-library/vue": "^8.1.0",
-    "@tsconfig/node22": "^22.0.5",
+    "@tsconfig/node26": "^26.0.1",
     "@types/cldrjs": "^0.4.29",
     "@types/jsdom": "^28.0.3",
     "@types/lodash-es": "^4.17.12",

pnpm-lock.yaml

@@ -6,7 +6,7 @@
   "scope": "/",
   "display": "standalone",
   "orientation": "portrait",
-  "theme_color": "#0e6ba8",
+  "theme_color": "#ffffff",
   "background_color": "#ffffff",
   "lang": "en",
   "dir": "ltr",
@@ -28,18 +28,6 @@
       "sizes": "any",
       "type": "image/svg+xml",
       "purpose": "maskable"
-    },
-    {
-      "src": "/apple-touch-icon.png",
-      "sizes": "192x192",
-      "type": "image/png",
-      "purpose": "any"
-    },
-    {
-      "src": "/apple-touch-icon.png",
-      "sizes": "512x512",
-      "type": "image/png",
-      "purpose": "any"
     }
   ]
 }

public/site.webmanifest

@@ -9,8 +9,11 @@ import { createApp } from 'vue'
 import { createPinia } from 'pinia'
 import * as Sentry from '@sentry/vue'
 import i18n from '@/i18n'
+import { recoverFromPreloadErrors } from '@/utils/preloadRecovery'
 import App from './App.vue'
 
+recoverFromPreloadErrors()
+
 // eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- .vue default export is untyped
 const app = createApp(App)
 
@@ -22,6 +25,9 @@ const sentryDSN = import.meta.env.VITE_SENTRY_DSN as string | undefined
 Sentry.init({
   app,
   dsn: sentryDSN,
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/prefer-nullish-coalescing -- untyped Vite env; an unset release arrives as an empty string, which `??` would forward
+  release: import.meta.env.VITE_SENTRY_RELEASE || undefined,
+  environment: import.meta.env.PROD ? 'production' : 'development',
   sendDefaultPii: false,
   integrations: [
     Sentry.vueIntegration({
@@ -32,6 +38,30 @@ Sentry.init({
   ],
   tracesSampleRate: 1.0,
   enableLogs: true,
+  ignoreErrors: [
+    // Browser-extension content scripts inject WebExtension messaging into
+    // the page; their failures are not our code and are unfixable here.
+    // Sentry TIM-DOT-CODES-6.
+    /runtime\.sendMessage/u,
+    // vite-plugin-pwa's injected SW registration throws InvalidStateError
+    // when Chrome registers during prerender. No elegant in-plugin or
+    // newer-version fix exists, so we filter the noise. Sentry
+    // TIM-DOT-CODES-5.
+    /Failed to register a ServiceWorker/u,
+    // Native in-app browsers (WKWebView wrappers) inject a bridge script that
+    // calls `window.webkit.messageHandlers`; it throws when that handler is
+    // absent. Not our code and unfixable here. Sentry TIM-DOT-CODES-8.
+    /messageHandlers/u,
+    // Android WebView tears down its JS bridge mid-post, so a `postMessage`
+    // from the injected bridge rejects with "Java object is gone". Not our
+    // code and unfixable here. Sentry RACCOONBETS-FRONTEND-D.
+    /Java object is gone/u,
+    // Microsoft's Outlook SafeLinks crawler rejects a promise from its own
+    // injected instrumentation while previewing a link. It arrives without a
+    // stacktrace from an Azure address, never from a visitor. Sentry
+    // TIM-DOT-CODES-C.
+    /Object Not Found Matching Id/u,
+  ],
 })
 
 /**
@@ -40,15 +70,18 @@ Sentry.init({
  * A failed registration costs offline caching and nothing else, so the
  * rejection is logged rather than left to surface as an unhandled error.
  */
-function registerServiceWorker() {
+function registerServiceWorker(): void {
   if (!('serviceWorker' in navigator)) return
 
   window.addEventListener('load', () => {
-    navigator.serviceWorker.register('/sw.js', { scope: '/' }).catch((error: unknown) => {
-      Sentry.logger.warn('Service worker registration failed', {
-        reason: error instanceof Error ? error.message : String(error),
+    const swURL = `${import.meta.env.BASE_URL}sw.js`
+    navigator.serviceWorker
+      .register(swURL, { scope: import.meta.env.BASE_URL })
+      .catch((error: unknown) => {
+        Sentry.logger.warn('Service worker registration failed', {
+          reason: error instanceof Error ? error.message : String(error),
+        })
       })
-    })
   })
 }
 

src/main.ts

@@ -0,0 +1,43 @@
+// A tab may spend one reload per cooldown recovering a failed chunk. Beyond that, an asset that
+// is genuinely unreachable would put the tab in a refresh loop.
+const RELOAD_KEY = 'preload-error-reload'
+const RELOAD_COOLDOWN_MS = 10 * 60 * 1000
+
+/**
+ * Reloads the page when a lazily-loaded chunk can't be fetched.
+ *
+ * Vite's preload helper rejects when a code-split chunk or its stylesheet fails to load — a
+ * dropped request, or a tab whose `index.html` predates the current deploy and so asks for asset
+ * hashes that no longer exist. Nothing downstream recovers on its own, so the reload fetches a
+ * fresh `index.html` and with it the current hashes.
+ *
+ * Reloads are limited to one per cooldown: a deploy that really is broken surfaces the failure to
+ * error reporting rather than refreshing forever, while a tab left open across several deploys
+ * still heals each time.
+ */
+export function recoverFromPreloadErrors(): void {
+  window.addEventListener('vite:preloadError', reloadOnce)
+}
+
+function reloadOnce(event: VitePreloadErrorEvent): void {
+  if (!claimReload()) return
+
+  // Suppresses Vite's rethrow: the reload is the recovery, so the rejection isn't worth
+  // reporting. A failure that can't claim a reload stays unprevented and reaches Sentry.
+  event.preventDefault()
+  window.location.reload()
+}
+
+function claimReload(): boolean {
+  try {
+    const lastReload = Number(window.sessionStorage.getItem(RELOAD_KEY) ?? 0)
+    if (Number.isFinite(lastReload) && Date.now() - lastReload < RELOAD_COOLDOWN_MS) return false
+
+    window.sessionStorage.setItem(RELOAD_KEY, String(Date.now()))
+    return true
+  } catch {
+    // sessionStorage may be unavailable (private mode, etc.). With nowhere to record the attempt
+    // a reload could loop, so decline it.
+    return false
+  }
+}

src/utils/preloadRecovery.ts

@@ -1,10 +1,11 @@
 {
-  "extends": "@tsconfig/node22/tsconfig.json",
-  "include": ["vite.config.*", "vitest.config.*", "nightwatch.conf.*", "playwright.config.*"],
+  "extends": "@tsconfig/node26/tsconfig.json",
+  "include": ["vite.config.*", "vitest.config.*", "playwright.config.*"],
   "compilerOptions": {
     "noEmit": true,
     "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.node.tsbuildinfo",
 
+    "strict": true,
     "module": "ESNext",
     "moduleResolution": "Bundler",
     "types": ["node"]

tsconfig.node.json

@@ -4,7 +4,7 @@
   "exclude": [],
   "compilerOptions": {
     "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.vitest.tsbuildinfo",
-    "lib": [],
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
     "types": ["node", "jsdom"],
     "paths": {
       "@/*": ["./src/*"],

tsconfig.vitest.json

@@ -6,11 +6,11 @@ import vueDevTools from 'vite-plugin-vue-devtools'
 import { VitePWA } from 'vite-plugin-pwa'
 
 // https://vite.dev/config/
-export default defineConfig(() => {
+export default defineConfig(({ command }) => {
   return {
     plugins: [
       vue(),
-      vueDevTools({ launchEditor: 'rubymine' }),
+      command === 'serve' && vueDevTools({ launchEditor: process.env.VITE_LAUNCH_EDITOR }),
       VitePWA({
         registerType: 'autoUpdate',
         manifest: false,
@@ -27,14 +27,14 @@ export default defineConfig(() => {
           skipWaiting: true,
         },
       }),
-    ],
+    ].filter(Boolean),
     resolve: {
       alias: {
         '@': fileURLToPath(new URL('./src', import.meta.url)),
       },
     },
     build: {
-      sourcemap: true,
+      sourcemap: 'hidden',
     },
   }
 })