ci: run full frontend/backend tests on public release by default

Add workflow_dispatch run_tests (default true). When enabled, run
web-element/web tests and scripts/ci/gate.sh, and package without -DskipTests.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Ar3h

.github/workflows/build-and-release.yml

@@ -18,6 +18,11 @@ on:
         required: false
         type: boolean
         default: false
+      run_tests:
+        description: "Run full backend (Maven / gate) and frontend (web + web-element) tests before packaging. Default: enabled. When enabled, product mvn does NOT pass -DskipTests."
+        required: false
+        type: boolean
+        default: true
 
 permissions:
   contents: write
@@ -34,6 +39,7 @@ jobs:
       source_ref: ${{ steps.meta.outputs.source_ref }}
       is_prerelease: ${{ steps.meta.outputs.is_prerelease }}
       publish_release: ${{ steps.meta.outputs.publish_release }}
+      run_tests: ${{ steps.meta.outputs.run_tests }}
       docker_tags: ${{ steps.meta.outputs.docker_tags }}
       chains_dev_jars_repository: ${{ steps.manifest.outputs.chains_dev_jars_repository }}
       chains_dev_jars_ref: ${{ steps.manifest.outputs.chains_dev_jars_ref }}
@@ -113,11 +119,21 @@ jobs:
             PUBLISH_RELEASE="false"
           fi
 
+          # Default: run full frontend + backend tests (only skip when explicitly false).
+          RUN_TESTS_INPUT="${{ inputs.run_tests }}"
+          if [ "$RUN_TESTS_INPUT" = "false" ]; then
+            RUN_TESTS="false"
+          else
+            RUN_TESTS="true"
+          fi
+
           echo "release_version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "release_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
           echo "source_ref=$SOURCE_REF" >> "$GITHUB_OUTPUT"
           echo "is_prerelease=$IS_PRERELEASE" >> "$GITHUB_OUTPUT"
           echo "publish_release=$PUBLISH_RELEASE" >> "$GITHUB_OUTPUT"
+          echo "run_tests=$RUN_TESTS" >> "$GITHUB_OUTPUT"
+          echo "run_tests=$RUN_TESTS publish=$PUBLISH_RELEASE"
           {
             echo "docker_tags<<EOF"
             echo "javachains/javachains:${VERSION}"
@@ -164,6 +180,8 @@ jobs:
   build:
     needs: resolve_release_meta
     runs-on: ubuntu-latest
+    # gate + frontend tests + package; allow headroom when run_tests=true
+    timeout-minutes: 120
     outputs:
       source_sha: ${{ steps.source_revision.outputs.source_sha }}
       frontend_sha: ${{ steps.frontend.outputs.frontend_sha }}
@@ -272,11 +290,12 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          # Match chains gate.yml / java-chains-server frontend.node.version
+          node-version: '22.12.0'
 
       - uses: pnpm/action-setup@v4
         with:
-          version: 9
+          version: 9.15.0
 
       - name: Cache Maven dependencies
         uses: actions/cache@v4
@@ -306,8 +325,70 @@ jobs:
             mvn clean install -DskipTests
           )
 
+      # ── Tests (default on via run_tests; set false only for emergency rebuilds) ──
+      - name: Install local deps for backend gate
+        if: needs.resolve_release_meta.outputs.run_tests == 'true'
+        env:
+          CHAINS_DEPS_TOKEN: ${{ secrets.DEPENDENCY_REPO_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -x scripts/ci/install-local-deps.sh ]; then
+            scripts/ci/install-local-deps.sh
+          else
+            echo "WARNING: scripts/ci/install-local-deps.sh missing; relying on release-deps installs"
+          fi
+
+      - name: Frontend tests (java-chains-web-element)
+        if: needs.resolve_release_meta.outputs.run_tests == 'true'
+        working-directory: java-chains-web-element
+        run: |
+          set -euo pipefail
+          pnpm install --frozen-lockfile
+          pnpm typecheck
+          pnpm test:run
+          # Public RMI surface defaults (same checks as chains gate.yml web-element job)
+          if [ -f tests/config/rmi-workbench.test.ts ]; then
+            pnpm exec vitest run tests/config/rmi-workbench.test.ts tests/adapters/rmi-menu-routes.test.ts
+          fi
+
+      - name: Frontend tests (java-chains-web)
+        if: needs.resolve_release_meta.outputs.run_tests == 'true'
+        run: |
+          set -euo pipefail
+          if [ ! -f java-chains-web/package.json ]; then
+            echo "java-chains-web absent; skip"
+            exit 0
+          fi
+          cd java-chains-web
+          npm ci
+          npm run typecheck
+          npm run test
+          if [ -f src/config/internal-features.test.ts ]; then
+            npm test -- --run src/config/internal-features.test.ts
+          fi
+
+      - name: Backend tests (scripts/ci/gate.sh)
+        if: needs.resolve_release_meta.outputs.run_tests == 'true'
+        env:
+          CHAINS_JDK8_HOME: ${{ env.JAVA_HOME }}
+        run: |
+          set -euo pipefail
+          test -x scripts/ci/gate.sh
+          scripts/ci/gate.sh
+
+      - name: Upload surefire reports on test failure
+        if: failure() && needs.resolve_release_meta.outputs.run_tests == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: surefire-reports-release
+          path: '**/target/surefire-reports/**'
+          retention-days: 7
+
       - name: Build Ship Artifacts (Element SPA + CLI)
+        env:
+          RUN_TESTS: ${{ needs.resolve_release_meta.outputs.run_tests }}
         run: |
+          set -euo pipefail
           # Product SPA = java-chains-web-element (pnpm → generated-resources/static).
           # Prefer in-tree ship script from chains; fall back to release-repo copy.
           if [ ! -f scripts/frontend/package-java-chains-web-element.sh ]; then
@@ -318,10 +399,22 @@ jobs:
           # ONE Maven invocation: second `mvn -am package` without -Pfrontend reuses
           # server target/ but a new maven.build.timestamp → Vector A session mismatch.
           # Product surface: server + java-chains-cli (no java-chains-sdk).
-          mvn -pl java-chains-server,java-chains-cli -am clean package \
-            -DskipTests -Pfrontend,with-exploits \
-            -Dfrontend.working.directory="${PWD}/java-chains-web-element" \
-            -Dfrontend.package.script="${PWD}/scripts/frontend/package-java-chains-web-element.sh"
+          MVN_ARGS=(
+            -pl java-chains-server,java-chains-cli
+            -am
+            clean
+            package
+            -Pfrontend,with-exploits
+            "-Dfrontend.working.directory=${PWD}/java-chains-web-element"
+            "-Dfrontend.package.script=${PWD}/scripts/frontend/package-java-chains-web-element.sh"
+          )
+          if [ "${RUN_TESTS}" = "true" ]; then
+            echo "run_tests=true: product mvn WITHOUT -DskipTests (test phase runs)"
+          else
+            echo "run_tests=false: product mvn WITH -DskipTests (tests skipped)"
+            MVN_ARGS+=(-DskipTests)
+          fi
+          mvn "${MVN_ARGS[@]}"
 
       - name: Prepare Base Artifacts
         run: |