CI: gate deploys on tests; upgrade to Node 24 LTS and nginx 1.30

.github/workflows/deploy.yml

@@ -3,14 +3,46 @@ name: Deploy to Azure Container Apps
 on:
   push:
     branches: [main]
+  pull_request:
   workflow_dispatch:
 
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: deancron/landrecon
 
 jobs:
+  # Runs on every PR and before every deploy; build-and-deploy is gated on it.
+  test:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+
+      - run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Unit tests
+        run: npm test
+
+      - name: Server tests
+        run: npm run test:server
+
+      # Typecheck + production bundle + bundle budget. API keys are omitted;
+      # the build doesn't need them to succeed.
+      - name: Build
+        run: npm run build
+
   build-and-deploy:
+    needs: test
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/snapshot-overpass.yml

@@ -40,7 +40,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version-file: .nvmrc
 
       # Login once, up front, so each dataset can upload itself immediately
       # after it's built rather than waiting for every script to finish.

.nvmrc

@@ -0,0 +1 @@
+24

Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1.6
 
 # Build stage - compile React frontend
-FROM node:20-alpine AS frontend-build
+FROM node:24-alpine AS frontend-build
 WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci
@@ -34,7 +34,10 @@ RUN --mount=type=secret,id=VITE_TOMTOM_API_KEY \
 # the Dev Todos JSON endpoint AND the per-URL Open Graph image/HTML
 # rendering (crawler share-link previews).  The Flask + GDAL tile server
 # was retired once airport noise moved to PMTiles served from blob storage.
-FROM nginx:1.27-alpine AS runtime
+FROM nginx:1.30-alpine AS runtime
+# The sidecars run on Alpine's packaged nodejs (Node 24 on nginx:1.30's
+# Alpine 3.24), matching the Node 24 build stage so better-sqlite3's
+# prebuilt musl binary for that ABI is used.
 # fontconfig + dejavu fonts are required for sharp/librsvg to actually
 # rasterize text in the OG SVG; without them every glyph renders as a
 # missing-glyph tofu box. ttf-dejavu is ~3MB and covers Latin + em-dash

README.md

@@ -106,7 +106,7 @@ providers and browser geolocation (no paid API calls), start the dev server with
 
 ```bash
 node scripts/location-report-check.mjs
-node --test server/og.test.mjs
+npm run test:server
 ```
 
 `LOCATION_TEST_URL` overrides the dev-server URL. `LOCATION_TEST_ARTIFACTS`