CI/CD part 1: GitHub Actions — fast suite per-PR, browser suite nightly (#639)

[mcfrank]

First half of #639 (the CI half). No CI existed before this — greenfield. Verified green in Actions: the test job passes 253 tests in ~37 min.

What lands

Two workflows, both driving the same docker-compose stack developers use locally, so "passes on my machine" and "passes in CI" are the same command.

• ci.yml — the per-PR gate. Runs the unit/integration suite (--exclude=selenium --exclude=known_failure --parallel auto) on every PR and push to master. ~37 min on GitHub's 2-core runners (the repo is public, so Actions minutes are free). This is the real protection.
• selenium.yml — nightly + on-demand. The browser suite (LiveServerTestCase + a Firefox grid) is the real guard for the jQuery 1→3.7.1 migration and interactive flows, but it's a 60–90 min run, so it runs on a nightly schedule and via the "Run workflow" button rather than blocking every PR. (@mcfrank chose this split.)

Things CI caught immediately (none are regressions from this stack)

• A ~285s-per-page Firefox stall. Both WebSiteOpensTests login-smoke classes created their session without --no-sandbox --disable-dev-shm-usage — 2 trivial tests took 291s and looked like a hang. Fixed (the other Selenium classes already had the flags).
• Two pre-existing pandas-3 bugs that pass locally (arm64, in isolation) but fail deterministically in the full CI run (amd64): to_json(orient='columns') duplicate-index (API: StudyAPI /api export crashes on pandas 3 (to_json duplicate-index) #640) and the scoring download's 'item_1' is not in list (CDI scoring download crashes: "'item_1' is not in list" (download_cdi_format) #649). Both change output shape to fix properly, so they're quarantined via @tag("known_failure") (excluded in ci.yml and make docker-test) and tracked — not fixed blind. This is the strongest argument for having CI: these are invisible on a dev Mac.
• Stale browser-test locators. ~21 flow tests wait for pre-facelift console markup (e.g. //a[@id='id_add_instruments'], removed in the verified redesign, commit e720eb0). The pages work (the fast page-smoke test hits them at 200); the tests need a locator refresh — Refresh Selenium browser-test locators for the post-facelift console #648. That's exactly the signal the nightly suite exists to produce.

Also

• .dockerignore — Dockerfile does COPY . /app with none, so every build shipped node_modules + .git for nothing (the runtime masks /app with the bind mount).
• Test-job timeout-minutes: 75 — the suite is ~18 min locally with many cores but ~37 min on 2-core runners. Sharding across runners is the real speed-up (follow-up).

Deferred on purpose

• The deploy half (eb deploy on merge via an OIDC role → retire the long-lived webcdi-deploy key). Needs an AWS OIDC provider + IAM role created first (only @mcfrank / @HenryMehta can), and auto-deploy to prod deserves its own review.
• A lint job. flake8/black/isort have no config, so they scan node_modules and error on vendored Python 2 — make docker-lint is broken today. Needs an exclude config first.

🤖 Generated with Claude Code