Skip to content

feat(BUY-8306): QA deployment gates Phase 1 (test + security) - #10

Open
BuyWhere wants to merge 49 commits into
mainfrom
feat/BUY-8306-qa-gates
Open

feat(BUY-8306): QA deployment gates Phase 1 (test + security)#10
BuyWhere wants to merge 49 commits into
mainfrom
feat/BUY-8306-qa-gates

Conversation

@BuyWhere

@BuyWhere BuyWhere commented May 8, 2026

Copy link
Copy Markdown
Collaborator

Summary

Adds QA deployment gates that must pass before any production/staging deploy proceeds.

Phase 1 Gates (this PR)

G1 — Test Gate

  • TypeScript compile check (tsc --noEmit)
  • Runs npm test with pass-through for empty test suites

G5 — Security Gate

  • npm audit --audit-level=high for dependency vulnerabilities
  • Gitleaks secret detection scan
  • Custom grep for hardcoded secrets in TypeScript source

Integration

  • New reusable workflow: .github/workflows/qa-gates.yml
  • Wired as prerequisite (needs: qa-gates) in both production and staging deploy workflows
  • Emergency bypass: set skip_tests=true / skip_gates=true in workflow dispatch

Phase 2 (deferred)

G2 (schema), G3 (data quality), G4 (performance) gates require stable staging — deferred until Railway stabilizes.

Test plan

  • Trigger staging deploy → verify QA gates run before build
  • Verify gate failure blocks deploy progression
  • Verify skip_gates=true bypasses all gates

Closes BUY-8306 (Phase 1)

🤖 Generated with Claude Code

Bolt (VP DevOps) and others added 30 commits May 7, 2026 05:58
- Add OpenGraph (og:title, og:description, og:image, og:type, og:siteName) to root layout
- Add Twitter Card meta (summary_large_image) with @BuyWhere creator
- Add metadataBase: https://buywhere.ai for URL resolution
- Add canonical URL (/) to homepage page metadata
- Remove merge conflict markers from robots.ts (was blocking homepage crawl with /home/ disallow)

Part of BUY-13196 (SEO audit)
…dpoint

AI agents reading llms.txt try to call resolve_product_query but get
'method not found' since the live MCP only has 6 tools.
Fixes discoverability-accuracy mismatch. BUY-13300 tracks the
Cloud Run redeploy needed for server-card.json accuracy.
- Change 7 tools → 6 tools (actual MCP count)
- Fix compare_prices → compare_products (actual tool name)
- Fix find_deals → removed (doesn't exist in MCP)
- Fix browse_categories → list_categories (actual tool name)
- Fix get_category_products → removed (doesn't exist in MCP)
- Add find_best_price (was missing from this page)
- Update example prompts to use correct tool names
- Fix example code format to match actual MCP schema

Aligns /integrate page with actual live MCP endpoint.
- 50 unique home appliance configs: french door refrigerators, washing machines, dryers, dishwashers, air fryers, coffee makers, vacuums, air purifiers, etc.
- No duplicates with existing 51 US entries
- Total US entries: 101
…-13108, BUY-13103)

- 42 Best Electronics configs: business/budget/ultrabooks/macbooks/phones/Android/drawing/OLED/QLED/monitors/earbuds/fitness/cameras/VR/drones/speakers/soundbars/keyboards/mice/webcams/mics/printers/routers/NAS/power banks/hubs/streaming/e-readers/projectors
- 10 Cheapest deal pages: iphone/laptop/tv/ps5/airpods/macbook/samsung-tv/ipad/dyson/switch
- 5 US Mirror pages: laptop/air-purifier/iphone/gaming/smartphone
- 2 duplicates skipped (already in original 101)
- Total US entries: 160
- 42 Best Electronics page routes
- 10 Cheapest deal page routes
- 5 US Mirror page routes
- Total new page routes: 59
The /docs/guides/mcp page showed only 5 MCP tools, omitting find_best_price
which is a live tool on the MCP endpoint. Updated both the markdown and HTML
versions of the tools table.
- Directory listings: ai-agent-tools-buywhere.md, alternativeto-buywhere.md, theres-an-ai-for-that-buywhere.md
- Blog: best-price-tracking-tools-singapore-brief.md
- Pages: best-headphones-singapore.md
- Full launch copy with tagline, gallery description, campaign copy
- Technical setup instructions, FAQ, related links
- Comparison with Honey, CamelCamelCamel, Keepa
- MCP server installation instructions
- API marketplace listing with endpoint documentation
- MCP tools reference
- Code examples in cURL, JavaScript, Python
- Use cases and pricing table
- For submission to API directories and marketplaces
- Compares BuyWhere vs Konker vs FakeStoreAPI vs Google Shopping
- MCP server support comparison
- Multi-country coverage (US + Singapore)
- API code examples
- SEO optimized with product comparison keywords
- Compares BuyWhere MCP vs Amazon MCP vs FakeStore MCP
- Feature matrix by retailer coverage, countries, real prices
- Integration example for Claude/Cursor MCP setup
- Decision guide for when to use each MCP server
- logo_url: https://api.buywhere.ai/logo.png (404) → https://buywhere.ai/favicon.svg (200)
- description_for_human: 'Singapore merchants only' → 'Cross-border catalog for AI agents, 1.5M+ products, SG/US/SEA'
- description_for_model: removed 'All prices in SGD by default' (inaccurate); added multi-currency support note

Needs Cloud Run redeploy (BUY-13300) to take effect.
Covers Patio Furniture, BBQ Grills, Garden Tools, Outdoor Dining,
Lawn Mowers, Bird Feeders, Solar Lights, Outdoor Storage, Garden
Hose, and Outdoor Speakers — the BUY-13404 categories missing from
editorial-content.json.
Targets featured snippets for key search queries:
- "what is an MCP server for ecommerce"
- "best MCP server for product search"
- "how to set up BuyWhere MCP"
- "BuyWhere vs Shopify MCP"
Fix wrong tool names (compare_prices, track_price, get_merchant_info)
with actual live tools (compare_products, get_deals, list_categories).
Match actual 6-tool MCP endpoint.
…-buywhere.md

- Fix wrong tools (compare_prices, get_merchant_info, track_price) → actual 6 tools
- Fix Smithery install command (was wrong package name)
- Fix usage examples with correct tool names and parameters
- Update pricing to match current (/bin/bash//9/Enterprise)
Targets key developer search queries:
- "what is MCP model context protocol"
- "how does BuyWhere use MCP"
- "which MCP clients support BuyWhere"
- "do I need credit card for BuyWhere"
- "what countries does BuyWhere support"
Targets integration search queries:
- "how to connect BuyWhere MCP to Claude Desktop"
- "BuyWhere MCP tools list"
- "do I need API key for BuyWhere MCP"
- "BuyWhere vs web scraping for AI agents"
- "BuyWhere free tier vs paid plans"
Targets key signup intent queries:
- "how to get BuyWhere API key"
- "is BuyWhere API free"
- "what can I build with BuyWhere API"
- "BuyWhere MCP support"
- "BuyWhere API countries coverage"
Fix wrong tools (compare_prices, get_merchant_info, track_price) with
actual 6 live tools (search_products, get_product, compare_products,
get_deals, list_categories, find_best_price) in:
- content/directory/ai-agent-tools-buywhere.md
- content/directory/theres-an-ai-for-that-buywhere.md
- content/compare/mcp-servers-shopping.md

Also fixes: wrong Smithery URL, wrong install command,
incorrect pricing tiers.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
Targets onboarding search queries:
- "how to get started with BuyWhere API"
- "how to connect BuyWhere MCP to AI agent"
- "what does BuyWhere API response look like"
- "what is resolve_product_query"
- "BuyWhere REST API vs MCP"
- Fix nginx.conf upstream api_backend to point to 127.0.0.1:3000 (Node API)
  instead of stale 8000 (Python-era process)
- Remove merge conflict markers from nginx-deploy.yml workflow file

Root cause: api.buywhere.ai was proxying to port 8000 which no longer
serves the Node API, causing 404 on updated api/dist bundle endpoints.
Renders content from content/compare/*.md with FAQPage schema.
Makes buywhere-smithery-faq and buywhere-vs-smithery-alternatives
discoverable as live pages instead of orphaned content files.
Handles content files like buywhere-mcp-developer-faq.md that
use markdown H1 instead of YAML frontmatter for the title field.
- src/app/directory/page.tsx — index listing all directory submissions
- src/app/directory/[...slug]/page.tsx — catch-all rendering content/directory/*.md
  with SoftwareApplication structured data for AI agent directories,
  MCP marketplaces, and API registries. Makes alternativeto,
  ai-agent-tools, mcp-buywhere, and theres-an-ai-for-that content
  discoverable as live pages at /directory/{slug}.
…l, JSON-LD extraction

- Scrapes /xmlsitemap.php for 5 product sitemap pages (~40K products)
- Extracts products via JSON-LD schema from product pages
- Async concurrency with asyncio.as_completed for true parallelism
- Checkpointing every batch (100 products) for resume on interrupt
- Batch POST to /v1/ingest/products

Co-Authored-By: Paperclip <noreply@paperclip.ing>
Targets search queries:
- "BuyWhere vs Lister AI"
- "Lister AI alternative for product search"
- "product search API vs chatbot platform"
- "AI shopping agent comparison"

Positioned as educational content for developers choosing between
commerce data APIs and customer support AI platforms.
…P FAQ

Fixes BUY-13271:
- Added resolve_product_query as 7th MCP tool to tools table
- Fixed Smithery URL: BuyWhere -> buywhere (lowercase)

Co-Authored-By: Paperclip <noreply@paperclip.ing>
Bolt (VP DevOps) and others added 19 commits May 7, 2026 12:58
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Targets search queries:
- "BuyWhere vs Constructor.io"
- "Constructor.io alternative"
- "product search API comparison"
- "site search vs cross-retailer price comparison"

Positioned for developers evaluating commerce data infrastructure.
…n timeout

Co-Authored-By: Paperclip <noreply@paperclip.ing>
…outs

Co-Authored-By: Paperclip <noreply@paperclip.ing>
Targets search queries:
- "BuyWhere vs Octane AI"
- "Octane AI alternative for product search"
- "Shopify quiz vs price comparison API"
- "product discovery platform comparison"
Targets search queries:
- "BuyWhere vs Copilot Shopping"
- "BuyWhere vs Bing Chat shopping"
- "AI product search API vs chatbot"
- "developer product data vs consumer chatbot"
Targets search queries:
- "BuyWhere vs Perplexity"
- "AI product search API vs answer engine"
- "Perplexity vs BuyWhere for shopping"
- "AI agent commerce data vs general search"
BUY-13464 AEO optimizations:
- Add application/openapi+json link tag to homepage metadata
- Add WebApplication JSON-LD schema with MCP server keywords
  (keywords: MCP, Model Context Protocol, AI agent, product catalog,
   price comparison API, shopping agent, commerce API, etc.)
- Links Smithery and Glama MCP registry listings in sameAs

Co-Authored-By: Paperclip <noreply@paperclip.ing>
- src/app/directory/page.tsx — index listing all directory submissions
- src/app/directory/[...slug]/page.tsx — renders content/directory/*.md
  with SoftwareApplication schema
- src/app/compare/[...slug]/page.tsx — renders content/compare/*.md
  with FAQPage schema for Q&A content

Restores routing infrastructure lost during workspace reset.
Targets search queries:
- "BuyWhere vs ChatGPT Shopping"
- "AI product search API vs consumer chatbot"
- "ChatGPT product discovery vs developer API"
Targets search queries:
- "BuyWhere vs Algolia"
- "Algolia alternative for product search"
- "site search vs cross-merchant price comparison"
Targets search queries:
- "BuyWhere vs Doofinder"
- "Doofinder alternative"
- "site search vs cross-merchant price API"
Targets search queries:
- "BuyWhere vs Klevu"
- "Klevu alternative"
- "AI shopping agent vs site search platform"
Targets search queries:
- "BuyWhere vs Google Gemini"
- "Google Gemini shopping vs developer API"
- "AI product search consumer vs developer"
AEO content asset targeting developer queries for cross-merchant
price comparison APIs and Google Shopping API alternatives.
Targets search queries:
- "BuyWhere vs Amazon Product Advertising API"
- "Amazon PA API alternative"
- "cross-merchant vs Amazon-only product search"
… crawling

- buywhere.ai (route handler + static file): disallow /home/, /PAP/, /BUY/, /v1/, /v2/, /api/, /api-reference/
- api.buywhere.ai (server.ts): disallow all crawlers (Disallow: /)
- Resolve merge conflicts in robots.txt and site.Dockerfile from a8194ee77

Co-Authored-By: Paperclip <noreply@paperclip.ing>
fix(BUY-13085): update robots.txt — block internal paths and API from crawling
Add reusable qa-gates.yml workflow with:
- G1 Test Gate: TypeScript compile check + npm test
- G5 Security Gate: npm audit + gitleaks + hardcoded secret detection
- Summary job that blocks deploy on any gate failure

Wire QA gates as prerequisite for both production and staging
Cloud Run deploy workflows. Emergency bypass via skip_gates input.

Phase 2 (G2 schema, G3 data quality, G4 perf) deferred until
Railway staging environment stabilizes.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
@BuyWhere

Copy link
Copy Markdown
Collaborator Author

👋 Bumping this PR — BuyWhere is a free, open MCP server for real-time product discovery across 100M+ live products (SG, SEA, US). We'd love to be included in your awesome list! Happy to answer any questions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant