Release v0.1.16: Deployment Workflows & CI/CD Foundation

12 February 2026

What changed

• Manual deploy workflow — New deploy.yml enables manual Vercel deployments via GitHub Actions with production/preview environment selection. Production deploys require typing "deploy" as a confirmation safeguard.
• Monthly billing cron job — New monthly-billing.yml runs at 2 AM UTC on the 1st of every month, calling the billing endpoint with API key auth. Supports dry-run mode for safe manual testing.
• CI hardened — Changed npm test --if-present to npm test so test failures properly break the build.
• Test infrastructure — Added Vitest with 19 tests validating workflow files, cron schedules, security patterns, and CODEOWNERS configuration.
• CODEOWNERS — All files now route PR reviews to @calmony/engineering.

Why it matters

This lays the CI/CD foundation for reliable, automated deployments and billing. The monthly billing job means credit deductions happen on schedule without manual intervention. Hardened CI catches test failures before they reach production.

Technical notes

• Three GitHub Secrets required: APP_URL, SANCTIONS_SYNC_API_KEY, VERCEL_TOKEN
• No hardcoded secrets or URLs in any workflow file
• Vitest configured with path aliases matching tsconfig