release: v0.14.0

Fourteen commits since v0.13.0. See CHANGELOG.md for the full list.

Two additions: `npm run doctor`, which runs the config doctor from a terminal — including inside the shipped image — and exits with the worst finding, so it can gate a deployment script; and a Playwright spec that loads all fourteen admin routes against a production build.

One change, invisible on screen: the admin panel got a form-field layer (#533).

Five fixes: grid.gap on both axes (#513), the dashboard status badge (#539), the journal editor's unsaved-changes guard (#538), essay paragraph markup (#537), and aria-pressed on the panel's switches and pickers.

.github/workflows/ci.yml

@@ -9,6 +9,12 @@ on:
     # at release time.
     branches: [main, dev]
 
+# Neither job writes anything back to the repository: they check out the
+# code, build it and report through the run itself. Read is all they need,
+# and declaring it here covers every job rather than each one separately.
+permissions:
+  contents: read
+
 # Cancel in-progress runs for the same PR / branch
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -88,3 +94,59 @@ jobs:
           done <<< "$unformatted"
           echo '' >> "$GITHUB_STEP_SUMMARY"
           echo 'Advisory only — this does not block the merge.' >> "$GITHUB_STEP_SUMMARY"
+
+  # Separate job because it needs a browser and a built server, and because a
+  # slow browser run should not hold up the fast type-check/test feedback.
+  #
+  # Only the admin smoke spec runs here. The other e2e specs render the public
+  # gallery, which needs a real Immich behind it — CI has none, so they would
+  # fail for reasons that have nothing to do with the change under test. The
+  # admin panel reads its state from the repo's config files and degrades
+  # gracefully when Immich is unreachable, so it is the part of the suite that
+  # can honestly run without a backend.
+  e2e-admin:
+    name: Admin panel smoke test
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install Chromium
+        run: npx playwright install --with-deps chromium
+
+      - name: Build
+        run: npm run build
+        env:
+          IMMICH_API_URL: http://localhost:2283
+          IMMICH_API_KEY: placeholder-key-for-ci
+          AUTH_SECRET: placeholder-secret-for-ci-builds-must-be-32-chars-long
+
+      # E2E_START runs the spec against `npm run start` rather than the dev
+      # server. #542 was a module-evaluation error in shipped output, so the
+      # build that ships is the one worth loading in a browser.
+      - name: Admin smoke test
+        run: npm run test:e2e:admin
+        env:
+          E2E_START: '1'
+          IMMICH_API_URL: http://localhost:2283
+          IMMICH_API_KEY: placeholder-key-for-ci
+          AUTH_SECRET: placeholder-secret-for-ci-builds-must-be-32-chars-long
+          ADMIN_PASSWORD: e2e-admin-password
+
+      - name: Upload Playwright report
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: playwright-report/
+          retention-days: 7