From e464449408ad69049478cfa7d5d7d3d7003d3d2c Mon Sep 17 00:00:00 2001
From: JOY <5027251+JOY@users.noreply.github.com>
Date: Sun, 13 Sep 2026 19:54:15 +0700
Subject: [PATCH] ci: run unit tests and biome lint on every pull request

The CI workflow built the app and the Docker image but never executed the unit test suite or the linter, so neither ran on any pull request. Add both as separate jobs. The test job supplies encryption keys that satisfy the boot guard's shape; they protect nothing in CI.

Lint is added as a visible job first. It becomes a required status check once it has been observed green on a pull request, so that pre-existing findings cannot block merges.
---
 .github/workflows/ci.yml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e3b1007da9..22c21febdc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,3 +50,36 @@ jobs:
           context: .
           file: ./docker/Dockerfile
           tags: documenso-${{ github.sha }}
+
+  unit_tests:
+    name: Unit tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      # The crypto helpers read these at import time. The values only need to
+      # satisfy the boot guard's shape; they protect nothing in CI.
+      NEXT_PRIVATE_ENCRYPTION_KEY: ci-only-primary-key-0123456789abcdef
+      NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY: ci-only-secondary-key-0123456789
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - uses: ./.github/actions/node-install
+
+      - name: Run unit tests
+        run: npm run test -w @documenso/lib
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - uses: ./.github/actions/node-install
+
+      - name: Biome
+        run: npm run lint