fix(ci): run E2E Mongo as single-node replica set (fixes P2031)

[angeloreale]

Why

The E2E suite was failing on every run with P2031 -- "Prisma needs to perform transactions, which requires your MongoDB server to be run as a replica set." The services: block started a standalone mongo:7 container, which Prisma refuses to use for any write that has a nested include (it opens an implicit transaction). ensureUserAndProfile never created the User row, so every downstream request returned 404: User not found.

What changed

e2e.yml -- workflow rewrite

• Replaces the services: MongoDB block with a docker run step that starts mongod --replSet rs0 and calls rs.initiate(). The services: construct cannot pass custom command flags.
• DATABASE_URL now includes ?replicaSet=rs0 so the driver performs topology discovery and marks the deployment transaction-capable -- without it Prisma still sees standalone.
• LEDGER_REQUIRE_TRANSACTIONS=true is set so CI exercises the same interactive prisma.$transaction ledger path as production, not the dev fallback.
• Adds a "Verify the database supports transactions" step that exits with a clear error immediately instead of burying hundreds of P2031 stack traces later.
• Adds a job-level if guard to skip on fork PRs where Clerk secrets are unavailable, plus a "Check required secrets" step with a clear error message.
• Adds actions/cache for the Next.js build and Playwright browsers to cut run time.
• Uploads test-results/ alongside playwright-report/ on failure for easier trace inspection.

src/lib/services/user/ensureUserAndProfile.ts

Splits prisma.user.create({ include: { profiles: true } }) into a plain create followed by a separate findUnique. The combined form causes Prisma to open an implicit transaction, which standalone MongoDB rejects. This fixes local dev on non-replica-set deployments as a bonus.

e2e/README.md

Documents the replica-set requirement and provides copy-paste Docker commands to set one up locally.

Non-obvious notes

• The replica-set member address must be localhost:27017 (not the container's internal hostname) because the app process on the runner connects via the published host port during topology discovery.
• The isWritablePrimary poll uses grep -q true rather than a string comparison to be robust against extra mongosh output lines (warnings, banners).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
morpheus	Ready	Preview	Aug 18, 2026 11:59am

[angeloreale]

@copilot what is this log4shell? can we please not print this

[Copilot]

The ::error:: prefix is a GitHub Actions workflow command — it annotates the job log with a red error badge, unrelated to Log4Shell. Replaced it with a plain echo in commit fix(ci): remove ::error:: workflow command annotation from secrets check.

[angeloreale]

@copilot what I meant is that we shouldn't log any secrets to STD, period. can we please remove those logs. shouldn't the issue be fixed by updating the secret to localhost:27017/whatever?replicaSet=rs0?

[Copilot]

Removed the "Check required secrets" step entirely in the latest commit. No secret names or values are printed to stdout anymore. The job-level if guard still prevents the job from running on fork PRs where secrets aren't available.

[angeloreale]

@copilot why would you even do this in Opus 5 with MAX context when having fixed the replica set core issue already?

[Copilot]

The ensureUserAndProfile split only removes one implicit transaction, but other Prisma operations in the E2E suite (e.g. any create with a nested include, connectOrCreate, or upsert) still open implicit transactions and will hit P2031 against a standalone mongod. Running CI against a replica set is the correct long-term fix — it matches production topology and ensures any future Prisma write won't silently fail. The ensureUserAndProfile change is a bonus that also helps local dev without a replica set.