docs: test-first workflow, coverage ratchet, definition of done; real gitlab-cicd test jobs

[rubiagatra]

Stacked on #153 → #151 → #150. References the coverage / test-coverage tasks and helpers those PRs add, so it lands last. Merge order: #150 → #151 → #153 → this.

Description 📋

docsite/content/moonrepo-testing.md

Was a list of build/start commands. Now documents how generated projects are tested:

• The loop — red → green → refactor, what "failing for the right reason" means, never weaken a test to get green.
• Which test to write first, per layer — one table for go-modular (domain, service, repository, handler, fx wiring, webhook receiver, third-party client, migration, whole app) and one for react-app (logic, component, route via renderAt, API call, e2e journey, shared-ui). Generalised from a downstream project; no project-specific rows.
• Fixtures — recorded, never invented; seeders are the only realistic-data source; redact PII.
• Coverage — honest denominator, floors ship at 0, and the ratchet rule: floor = measured − 5, only ever raised, history recorded next to the value.
• Definition of done — generic checklist.
• CI — reproduce a clean checkout locally before pushing task/CI changes (MOON_CACHE=off, git clean -fdX) and why: inferred tasks have no declared outputs, and generated inputs must be produced by a dependency. This is the lesson from a day lost downstream.
• The old smoke-test commands survive under "Template smoke tests".

contribution-guidelines.md §6

The Tests bullet links to the page and carries the clean-checkout advice.

templates/gitlab-cicd/test/all.yml

Replaces the echo "Running test..." stub with jobs mirroring the local gates so CI and moon run … agree:

• lint-typecheck-build — affected projects only (--affected --downstream deep), or everything if a workspace-level file changed; fails if lint --fix produced a diff.
• test-api — Docker-in-Docker for testcontainers (ryuk disabled, host override), moon run <api>:coverage, the gate's overall line as the job coverage regex, JUnit + coverage artifacts.
• .test-frontend job template + one example SPA job — moon run <spa>:test-coverage, Lines regex, JUnit from tests-results/junit.xml.
• Uses the template's existing .setup and .rules:merge-request anchors; CHANGEME_API_APP / CHANGEME_WEB_APP placeholders follow the template's CHANGEME_* convention.

templates/gitlab-cicd/.gitlab/merge_request_templates/Default.md

The definition-of-done checklist as an MR template (generic: persistence / queue / integration / third-party contract sections).

Noticed, not changed

templates/gitlab-cicd/.gitlab-ci.yml includes /deploy/pipelines/test/test.yml, but the file is test/all.yml and the template's destination is infra/[package_name] (the other includes use /infra/...). Looks like pre-existing drift — happy to fix in this PR if you confirm the intended paths.

Type of change 🤔

• Documentation (a change to documentation)
• Feature (non breaking change which adds functionality) — the gitlab-cicd test jobs

Submission checklist ✅

• I have performed a self review of my changes
• I have updated the documentation where relevant
• My changes are well written and all ci is passing

🤖 Generated with Claude Code