Fix CI build/deploy/smoke pipeline for the self-hosted qa runner (#3)

## Summary
- Fix a chain of QA CI issues: Docker build/health-check flakiness, NuGet vuln pins, then adds the post-deploy integration + Playwright smoke suite and works through everything needed to make it actually run on the self-hosted `qa` runner (musl/Alpine job container, no node/dotnet/curl preinstalled, docker-outside-of-docker networking).
- Adds a fixed dev/QA seed admin user + fixed Development environment API key so integration tests and e2e specs have a stable target.
- Pins Aspire's `AppHost.cs` ports/credentials to match the docker-compose local dev defaults.
- Adds `tests/api/MicCheck.Api.Tests.Integration` coverage for disabled flags, environment-document bootstrap, identity override precedence, auth login, and unauthorized access; adds a Playwright e2e suite under `src/admin/e2e` (login, nav, context selection, features CRUD/toggle).
- Adds a `smoke-qa` CI job that runs both suites against the just-deployed QA stack, working around: no curl/node/dotnet on the bare runner, musl vs glibc (Playwright browsers run via the official `mcr.microsoft.com/playwright` image instead), and the runner's job-container network isolation (reach the QA stack via the docker bridge gateway IP; `docker cp` instead of a bind mount to get files into the playwright container, since paths don't cross the docker-outside-of-docker boundary).

## Test plan
- [x] Unit tests pass (dotnet test tests/api/MicCheck.Api.Tests.Unit, 243 passed)
- [x] API integration suite passes against the real QA stack in CI
- [x] Playwright e2e suite passes against the real QA stack in CI (verified 3/3 locally against a real dev API + vite server for the flakiest spec)
- [x] Full CI pipeline (build → deploy-qa → smoke-qa) green end to end on the qa runner

Reviewed-on: #3

src/MicCheck.AppHost/AppHost.cs

@@ -1,14 +1,26 @@
 var builder = DistributedApplication.CreateBuilder(args);
 
-var postgres = builder.AddPostgres("postgres").WithDataVolume("miccheck-pgdata").WithPgAdmin();
+// Pinned to match tests/api/MicCheck.Api.Tests.Integration/local.runsettings and
+// src/admin's docker-compose defaults, so those fixed targets work whether the
+// stack is run via `docker compose` or via this AppHost.
+var postgresUser = builder.AddParameter("postgres-username", "miccheck");
+var postgresPassword = builder.AddParameter("postgres-password", "password", secret: true);
+
+var postgres = builder.AddPostgres("postgres", postgresUser, postgresPassword, port: 5432)
+    .WithDataVolume("miccheck-pgdata")
+    .WithPgAdmin();
 
 var miccheckDb = postgres.AddDatabase("miccheck");
 
-var api = builder.AddProject<Projects.MicCheck_Api>("api").WithReference(miccheckDb).WaitFor(miccheckDb);
+var api = builder.AddProject<Projects.MicCheck_Api>("api")
+    .WithReference(miccheckDb)
+    .WaitFor(miccheckDb)
+    .WithHttpEndpoint(port: 5000, name: "http");
 
 builder.AddViteApp("admin", "../admin", "serve")
     .WithReference(api)
     .WaitFor(api)
+    .WithHttpEndpoint(port: 5173, name: "http")
     .WithExternalHttpEndpoints();
 
 builder.Build().Run();

src/MicCheck.AppHost/MicCheck.AppHost.csproj

@@ -8,6 +8,7 @@
   <ItemGroup>
     <PackageReference Include="Aspire.Hosting.JavaScript" Version="13.4.2" />
     <PackageReference Include="Aspire.Hosting.PostgreSQL" Version="13.4.0" />
+    <PackageReference Include="MessagePack" Version="2.5.302" />
   </ItemGroup>
 
   <PropertyGroup>

src/admin/e2e/context-selection.e2e.ts

@@ -0,0 +1,30 @@
+import { test, expect } from '@playwright/test';
+import { authFile } from './global-setup';
+
+test.use({ storageState: authFile });
+
+/**
+ * The seeded DB (DatabaseSeeder) provides exactly one org, one project ("My Project"), and
+ * three environments (Development/Staging/Production), so the selectors auto-populate without
+ * needing to create anything first. Most feature screens require both a project and an
+ * environment to be selected before they render real content.
+ */
+test('project and environment context is selectable and persists across a reload', async ({ page }) => {
+  await page.goto('/features');
+
+  const projectSelect = page.getByTestId('project-select').locator('input');
+  const envSelect = page.getByTestId('env-select').locator('input');
+
+  await expect(projectSelect).not.toHaveValue('');
+  await expect(envSelect).not.toHaveValue('');
+
+  // Explicitly re-select the project via the dropdown to prove the selector itself works,
+  // not just the auto-select-on-load behavior.
+  await page.getByTestId('project-select').click();
+  await page.getByRole('option', { name: 'My Project' }).click();
+  await expect(projectSelect).toHaveValue('My Project');
+
+  await page.reload();
+  await expect(page.getByTestId('project-select').locator('input')).not.toHaveValue('');
+  await expect(page.getByTestId('env-select').locator('input')).not.toHaveValue('');
+});

src/admin/e2e/features.e2e.ts

@@ -0,0 +1,47 @@
+import { test, expect } from '@playwright/test';
+import { authFile } from './global-setup';
+
+test.use({ storageState: authFile });
+
+test('the features table renders for the selected project', async ({ page }) => {
+  await page.goto('/features');
+
+  await expect(page.getByTestId('features-table')).toBeVisible();
+  await expect(page.getByText('Select a project')).toHaveCount(0);
+});
+
+test('creating a feature adds it to the table and its toggle can be flipped', async ({ page }) => {
+  const featureName = `e2e_feature_${Date.now()}`;
+
+  await page.goto('/features');
+
+  await page.getByTestId('create-feature-btn').click();
+  await page.getByTestId('feature-name-input').locator('input').fill(featureName);
+  await page.getByTestId('feature-dialog-save').click();
+
+  const row = page.getByRole('row', { name: new RegExp(featureName) });
+  await expect(row).toBeVisible();
+
+  // Creating a feature triggers a fresh fetch of feature states for the current environment;
+  // wait for it to settle so the toggle below acts on real, loaded state rather than racing it.
+  await page.waitForLoadState('networkidle');
+
+  const toggle = row.locator('input[type="checkbox"]');
+  const wasChecked = await toggle.isChecked();
+
+  // Assert on the real PATCH landing, not just the switch's transient DOM state: if the
+  // feature-state map hasn't loaded for this row yet, the click handler no-ops silently and
+  // the switch briefly flashes the native checkbox state before Vue snaps it back - which
+  // reads as "toggled" for an instant even though nothing was ever sent to the API.
+  const patchResponse = page.waitForResponse(
+    (res) => res.request().method() === 'PATCH' && res.url().includes('/featurestate/') && res.ok(),
+  );
+  await toggle.click({ force: true });
+  await patchResponse;
+  await expect(toggle).toBeChecked({ checked: !wasChecked });
+
+  // Reload to confirm the toggle was persisted to the real API/DB, not just local state.
+  await page.reload();
+  const reloadedRow = page.getByRole('row', { name: new RegExp(featureName) });
+  await expect(reloadedRow.locator('input[type="checkbox"]')).toBeChecked({ checked: !wasChecked });
+});

src/admin/e2e/global-setup.ts

@@ -0,0 +1,30 @@
+import { chromium, type FullConfig } from '@playwright/test';
+import path from 'node:path';
+
+/**
+ * Deterministic dev/QA seed admin credentials — see DatabaseSeeder.SeedAdminEmail /
+ * SeedAdminPassword in src/api/MicCheck.Api/Data/DatabaseSeeder.cs. Seeding only ever runs in
+ * Development, which is what both local dev and the QA deployment run as.
+ */
+const ADMIN_EMAIL = process.env.E2E_ADMIN_EMAIL ?? 'admin@miccheck.local';
+const ADMIN_PASSWORD = process.env.E2E_ADMIN_PASSWORD ?? 'MicCheckQa!2026';
+
+export const authFile = path.join(__dirname, '.auth', 'admin.json');
+
+export default async function globalSetup(config: FullConfig): Promise<void> {
+  const baseURL = config.projects[0]?.use?.baseURL ?? 'http://localhost:5173';
+
+  const browser = await chromium.launch();
+  const page = await browser.newPage({ baseURL });
+
+  await page.goto('/login');
+  await page.getByTestId('email-input').locator('input').fill(ADMIN_EMAIL);
+  await page.getByTestId('password-input').locator('input').fill(ADMIN_PASSWORD);
+  await page.getByTestId('login-submit').click();
+
+  // A successful login redirects off /login onto the authenticated shell.
+  await page.waitForURL((url) => !url.pathname.startsWith('/login'), { timeout: 15_000 });
+
+  await page.context().storageState({ path: authFile });
+  await browser.close();
+}

src/admin/e2e/login.e2e.ts

@@ -0,0 +1,32 @@
+import { test, expect } from '@playwright/test';
+
+/**
+ * Unauthenticated — does not use the shared storageState fixture (see global-setup.ts) since
+ * it exercises the login flow itself.
+ */
+test.use({ storageState: { cookies: [], origins: [] } });
+
+const ADMIN_EMAIL = process.env.E2E_ADMIN_EMAIL ?? 'admin@miccheck.local';
+const ADMIN_PASSWORD = process.env.E2E_ADMIN_PASSWORD ?? 'MicCheckQa!2026';
+
+test('valid credentials sign the admin in and land on the authenticated shell', async ({ page }) => {
+  await page.goto('/login');
+
+  await page.getByTestId('email-input').locator('input').fill(ADMIN_EMAIL);
+  await page.getByTestId('password-input').locator('input').fill(ADMIN_PASSWORD);
+  await page.getByTestId('login-submit').click();
+
+  await page.waitForURL((url) => !url.pathname.startsWith('/login'));
+  await expect(page.getByText('Features', { exact: true })).toBeVisible();
+});
+
+test('invalid credentials surface a login error and stay on the login page', async ({ page }) => {
+  await page.goto('/login');
+
+  await page.getByTestId('email-input').locator('input').fill(ADMIN_EMAIL);
+  await page.getByTestId('password-input').locator('input').fill('not-the-right-password');
+  await page.getByTestId('login-submit').click();
+
+  await expect(page.getByTestId('login-error')).toBeVisible();
+  await expect(page).toHaveURL(/\/login/);
+});

src/admin/e2e/navigation.e2e.ts

@@ -0,0 +1,23 @@
+import { test, expect } from '@playwright/test';
+import { authFile } from './global-setup';
+
+test.use({ storageState: authFile });
+
+test('the sidebar renders and each primary link navigates to its view', async ({ page }) => {
+  await page.goto('/dashboard');
+
+  const links: Array<[name: string, path: string]> = [
+    ['Dashboard', '/dashboard'],
+    ['Features', '/features'],
+    ['Segments', '/segments'],
+    ['Identities', '/identities'],
+    ['Audit Logs', '/audit-logs'],
+    ['Settings', '/settings'],
+  ];
+
+  for (const [name, path] of links) {
+    // Sidebar entries are clickable divs (VerticalNavLink), not <a> elements, so match by text.
+    await page.locator('li').filter({ hasText: name }).first().click();
+    await expect(page).toHaveURL(new RegExp(`${path}$`));
+  }
+});

src/admin/nginx.conf

@@ -20,6 +20,14 @@ server {
         proxy_read_timeout 30s;
     }
 
+    # Proxy the API's health endpoint, which lives outside the /api prefix.
+    location = /health {
+        resolver           127.0.0.11 valid=10s ipv6=off;
+        set $api_upstream  http://api:8080;
+        proxy_pass         $api_upstream/health;
+        proxy_http_version 1.1;
+    }
+
     # SPA fallback — all other paths serve index.html so Vue Router handles them
     location / {
         try_files $uri $uri/ /index.html;

src/admin/package-lock.json

@@ -26,6 +26,7 @@
         "@babel/core": "^7.24.0",
         "@babel/preset-env": "^7.24.0",
         "@babel/preset-typescript": "^7.24.0",
+        "@playwright/test": "^1.61.1",
         "@types/jest": "^29.5.12",
         "@types/node": "^20.12.0",
         "@vitejs/plugin-vue": "^6.0.6",
@@ -3352,6 +3353,21 @@
         "node": ">=14"
       }
     },
+    "node_modules/@playwright/test": {
+      "version": "1.61.1",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.61.1.tgz",
+      "integrity": "sha512-8nKv6+0RJSL9FE4jYOEGXnPeM/Hg12qZpmqzZjRh3qM0Y7c3z1mrOTfFLids72RDQYVh9WpLEfR5WdpNX4fkig==",
+      "dev": true,
+      "dependencies": {
+        "playwright": "1.61.1"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@rolldown/binding-android-arm64": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.3.tgz",
@@ -9435,6 +9451,50 @@
         "node": ">=8"
       }
     },
+    "node_modules/playwright": {
+      "version": "1.61.1",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.61.1.tgz",
+      "integrity": "sha512-DWnY5o3YbLWK4GovuAVwpqL+1VwGNdUGrRr++8j8PtQQzvAVZUIMjKQ90fY689sEJZJBbZVw1rXaOKSTitkzPQ==",
+      "dev": true,
+      "dependencies": {
+        "playwright-core": "1.61.1"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.61.1",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.61.1.tgz",
+      "integrity": "sha512-h7Qlt6m4REp25qvIdvbDtVmD4LqVXfpRxhORv9L0jzETM05p4fuPJ3dKyuSXQxDSbXnmS79HAgi9589lGSpLkg==",
+      "dev": true,
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/playwright/node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
     "node_modules/postcss": {
       "version": "8.5.15",
       "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",

src/admin/package.json

@@ -7,7 +7,9 @@
     "build:dev": "vite build --mode development",
     "serve": "vite",
     "preview": "vite preview",
-    "test": "jest --passWithNoTests"
+    "test": "jest --passWithNoTests",
+    "e2e": "playwright test",
+    "e2e:install": "playwright install --with-deps chromium"
   },
   "dependencies": {
     "@fontsource-variable/inter": "^5.2.8",
@@ -28,6 +30,7 @@
     "@babel/core": "^7.24.0",
     "@babel/preset-env": "^7.24.0",
     "@babel/preset-typescript": "^7.24.0",
+    "@playwright/test": "^1.61.1",
     "@types/jest": "^29.5.12",
     "@types/node": "^20.12.0",
     "@vitejs/plugin-vue": "^6.0.6",

src/admin/playwright.config.ts

@@ -0,0 +1,29 @@
+import { defineConfig, devices } from '@playwright/test';
+
+/**
+ * Smoke-test suite for the admin SPA. Runs against a real, already-running deployment
+ * (local dev server or a deployed QA environment) — it does not mock the API and does not
+ * start any servers itself. See e2e/global-setup.ts for how authentication is bootstrapped.
+ */
+export default defineConfig({
+  testDir: './e2e',
+  testMatch: '**/*.e2e.ts',
+  fullyParallel: false,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 1 : 0,
+  workers: 1,
+  reporter: process.env.CI ? [['list'], ['html', { open: 'never' }]] : 'list',
+  globalSetup: './e2e/global-setup.ts',
+  timeout: 30_000,
+  use: {
+    baseURL: process.env.E2E_BASE_URL ?? 'http://localhost:5173',
+    trace: 'retain-on-failure',
+    screenshot: 'only-on-failure',
+  },
+  projects: [
+    {
+      name: 'chromium',
+      use: { ...devices['Desktop Chrome'] },
+    },
+  ],
+});

src/api/MicCheck.Api/Data/DatabaseSeeder.cs

@@ -1,5 +1,7 @@
 using MicCheck.Api.Organizations;
 using MicCheck.Api.Projects;
+using MicCheck.Api.Users;
+using Microsoft.AspNetCore.Identity;
 using Microsoft.EntityFrameworkCore;
 using AppEnvironment = MicCheck.Api.Environments.Environment;
 
@@ -7,11 +9,26 @@ namespace MicCheck.Api.Data;
 
 public class DatabaseSeeder
 {
-    private readonly MicCheckDbContext _db;
+    /// <summary>
+    /// Deterministic credentials for the development/QA seed admin user. Only ever created when
+    /// <c>SeedAsync</c> runs, which is gated behind <c>IsDevelopment()</c> in Program.cs.
+    /// Used by the API integration suite and the Playwright admin e2e suite to authenticate
+    /// without depending on per-run registration.
+    /// </summary>
+    public const string SeedAdminEmail = "admin@miccheck.local";
+    public const string SeedAdminPassword = "MicCheckQa!2026";
 
-    public DatabaseSeeder(MicCheckDbContext db)
+    /// <summary>Deterministic environment key for the seeded Development environment, so
+    /// HTTP-only integration/e2e tests can read flags without a direct DB connection.</summary>
+    public const string SeedDevelopmentEnvironmentKey = "env-qa-development";
+
+    private readonly MicCheckDbContext _db;
+    private readonly IPasswordHasher<User> _passwordHasher;
+
+    public DatabaseSeeder(MicCheckDbContext db, IPasswordHasher<User> passwordHasher)
     {
         _db = db;
+        _passwordHasher = passwordHasher;
     }
 
     public async Task SeedAsync(CancellationToken ct = default)
@@ -42,12 +59,34 @@ public class DatabaseSeeder
             _db.Environments.Add(new AppEnvironment
             {
                 Name = name,
-                ApiKey = $"env-{Guid.NewGuid():N}",
+                ApiKey = name == "Development" ? SeedDevelopmentEnvironmentKey : $"env-{Guid.NewGuid():N}",
                 ProjectId = project.Id,
                 CreatedAt = DateTimeOffset.UtcNow
             });
         }
 
         await _db.SaveChangesAsync(ct);
+
+        var adminUser = new User
+        {
+            Email = SeedAdminEmail,
+            FirstName = "MicCheck",
+            LastName = "Admin",
+            IsActive = true,
+            CreatedAt = DateTimeOffset.UtcNow,
+            PasswordHash = string.Empty
+        };
+        adminUser.PasswordHash = _passwordHasher.HashPassword(adminUser, SeedAdminPassword);
+        _db.Users.Add(adminUser);
+        await _db.SaveChangesAsync(ct);
+
+        _db.OrganizationUsers.Add(new OrganizationUser
+        {
+            OrganizationId = organization.Id,
+            UserId = adminUser.Id,
+            Role = OrganizationRole.Admin,
+            IsPrimary = true
+        });
+        await _db.SaveChangesAsync(ct);
     }
 }

src/api/MicCheck.Api/Dockerfile.ci

@@ -17,6 +17,11 @@ COPY src/api/MicCheck.Api/ src/api/MicCheck.Api/
 RUN dotnet publish src/api/MicCheck.Api/MicCheck.Api.csproj -c Release -o /out --no-restore
 
 FROM mcr.microsoft.com/dotnet/aspnet:10.0
+
+# curl is used by the docker-compose healthcheck; the base image ships neither
+# curl nor wget, so the healthcheck silently fails as "unhealthy" without it.
+RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /app
 COPY --from=build /out .
 EXPOSE 8080

src/api/MicCheck.Api/MicCheck.Api.csproj

@@ -12,6 +12,7 @@
     <PackageReference Include="FluentValidation.AspNetCore" Version="11.3.0" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.5" />
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.5" />
+    <PackageReference Include="Microsoft.OpenApi" Version="2.9.0" />
     <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.5" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.5" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.5">