[AnishSarkar22]

What

• Adds desktop-tests.yml for surfsense_local: the desktop backend (ruff, bandit, unit and integration tests), frontend (translation checks, typecheck, lint, tests) and Electron (typecheck, tests), each job run only when its own files change. Before this, no workflow ran the desktop tests.
• Adds docker-tests.yml for surfsense_backend and surfsense_web, replacing backend-tests.yml and e2e-tests.yml: backend lint (ruff, bandit), web lint (Biome), backend unit and integration tests, and the e2e journey, each run only when its files change.
• code-quality.yml now keeps only the checks that belong to no product, run on every PR: YAML/JSON/TOML, merge conflicts, large files, debug statements, case conflicts, check-docs and detect-secrets. Its jobs used to run every hook minus a skip list, so newer hooks leaked in: check-docs ran four times per PR, and Biome ran on every PR whether the web app changed or not.
• Each workflow ends in a gate (Docker Gate, Desktop Gate, Quality Gate) that always reports, passes when its product wasn't touched, and fails on failed or cancelled jobs. The old gates let a cancelled or timed-out job through. The gates can now be made required checks without blocking PRs for the other product.
• Path filters are per job, not per workflow, as GitHub recommends: a skipped workflow leaves its checks pending, while a skipped job reports success.
• bandit is split into bandit-docker and bandit-desktop aliases, so each product scans only its own code. The desktop backend had no security scan before.
• The desktop frontend job fails on an en.json that doesn't match the code. Before, typecheck regenerated it silently and CI passed.
• Pins pnpm 11.27.1 in surfsense_local/frontend and surfsense_local/electron. The desktop workflows and release-local.yml read it from those files, surfsense_web keeps its own pnpm 10.26.0, and the root package.json is removed.
• Node 24 for the desktop app and Node 20 for the web app, each matching its own setup; every action is on its latest version.
• Pre-commit:
  • Biome runs only when a commit touches surfsense_web.
  • Biome and formatjs run from each app's own install (pnpm exec, and a new translations:verify script), so their versions live only in package.json.
  • Hook versions updated: pre-commit-hooks v6.0.0, bandit 1.9.4, commitizen v4.19.0, and ruff v0.15.8 to match surfsense_backend's own ruff.
• Docs: CONTRIBUTING.md, ROADMAP.md, localization.md, packaging.md, docs/contracts/README.md and the translate skill describe the new workflows and commands.
• Known and not fixed here:
  • surfsense_web has 10 existing Biome formatting errors, so Web Lint will fail on web PRs until they are fixed.
  • surfsense_backend has 4 existing bandit B324 findings, which fail a PR only if it touches one of those files.
• After merging: no status checks are required on dev or main today. To block failing PRs from merging, add Docker Gate, Desktop Gate and Quality Gate as required checks in the repository settings.
• To test: the workflows run on this PR itself. A PR that touches only one product should run that product's jobs, while the other product's workflow skips its jobs and its gate passes.

Why

Fixes #

How to test

High-level PR Summary

This PR consolidates continuous integration for the desktop application (surfsense_local) by creating desktop-tests.yml, which runs backend (Python), frontend (TypeScript) and Electron tests in separate jobs triggered only when relevant files change. The workflow mirrors docker-tests.yml's new structure, which now tests the Docker product (surfsense_backend and surfsense_web) with similar path filtering and separation of linting, unit tests, integration tests and end-to-end journeys. code-quality.yml becomes a cross-product workflow that handles only file hygiene, docs and secrets scanning, delegating all product-specific linting and testing to the product workflows. Pre-commit hooks and documentation are updated to reflect that each product now manages its own testing pipeline, and pnpm version pinning is centralized in each product's package.json.

⏱️ Estimated Review Time: 15-30 minutes

💡 Review Order Suggestion

Order	File Path
1	.github/workflows/code-quality.yml
2	.github/workflows/backend-tests.yml
3	.github/workflows/e2e-tests.yml
4	.github/workflows/docker-tests.yml
5	.github/workflows/desktop-tests.yml
6	.pre-commit-config.yaml
7	.github/workflows/release-local.yml
8	CONTRIBUTING.md
9	docs/ROADMAP.md
10	docs/architecture/localization.md
11	docs/architecture/packaging.md
12	docs/contracts/README.md
13	package.json
14	surfsense_local/electron/package.json
15	surfsense_local/frontend/package.json
16	surfsense_backend/tests/e2e/auth_mint.py
17	.agents/skills/translate/SKILL.md

[vercel]

@AnishSarkar22 is attempting to deploy a commit to the Rohan Verma's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 26a4d28b-de74-4c26-8f73-4d8dd356eb1c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}