c2ebd18cf0
Removes `continue-on-error: true` from `.github/workflows/visual-diff.yml`'s `Capture screenshots (PR)` step. Visual drift is now a real merge gate on UI-touching PRs. Brief 2/2 of the `harden-visual-diff-gate` convoy. PR #138 shipped the seed workflow (Brief 1); PR #139 (`54495fe`) landed the fresh Linux baseline regenerated against post-glass-redesign main on CT 111. With a known-good baseline committed, the gate can flip without false-failing every UI-touching PR. ## What changes - `.github/workflows/visual-diff.yml` — drop the `continue-on-error: true` flag; add an inline rationale block linking to the convoy + the operator runbook for both intentional changes (dispatch seed workflow → manually open PR → merge → re-run) and unintentional regressions (inspect artifact diff → fix → push). - `.github/workflows/ci.yml` — add 9th `forbidden-patterns` check that greps `visual-diff.yml` for `^\s*continue-on-error:\s*true` and fails the build if it returns. Risk #3 of the convoy made concrete: prevents silent re-introduction via template revert. Scoped narrowly to that one file; other workflows (`seed-visual-baselines.yml`'s PR-open step, etc.) legitimately use the flag. Job name bumped from "Forbidden patterns (8 checks)" → "(9 checks)". All `Check N/8` group labels renumbered to `N/9`. - `AGENTS.md` — § Testing § Visual baselines rewritten to drop the "Known staleness as of 2026-06-12" callout (resolved by PR #139); § Testing § Screenshot diff rewritten to lead with "hard merge gate", document the intentional-change runbook, reference the new ci.yml check, and explicitly mention the org-setting caveat for the seed workflow's auto-PR step. - `tests/visual/homepage.spec.ts` — module docblock rewritten to match the AGENTS.md runbook: drops the "advisory, not gating" language; promotes the seed-visual-baselines workflow as the primary re-seeding path; demotes the Playwright Docker image to the offline fallback. - `.github/workflows/seed-visual-baselines.yml` — patches the `peter-evans/create-pull-request@v6` PR-open failure case discovered during Brief 1's first dispatch (run 27454132468). The PR-open step is now `continue-on-error: true` (narrowly scoped, with an inline rationale callout distinguishing it from the just-removed `visual-diff.yml` flag — that one silently hid real UI regressions; this one fronts a known org-level "Allow GitHub Actions to create and approve pull requests" limitation with a loud failure notice). New steps disambiguate the three possible outcomes (no-changes / pr-opened / branch-pushed-pr-blocked) via a `git ls-remote` check on the bot branch and exit non-zero on the blocked-PR case so the workflow run shows red and the operator gets the exact `gh pr create` command in the run logs. - `.convoys/harden-visual-diff-gate.md` — status: shipping; Step 2 marked SHIPPED; Decision D4 ratified (chose option C: accept org setting, document manual `gh pr create` fallback). Inline links to PR #139 + PR #140. ## Test plan - [x] `npm run lint` — clean (1 pre-existing unrelated warning) - [x] `npm run test:run` — 24 files / 118 tests pass - [ ] CI on this PR: 9th forbidden-patterns check passes; visual-diff job passes against the fresh baseline; convoy-metrics-gate passes (2 new rows added by this commit) - [ ] After merge: smoke test the 9th check by opening a throwaway PR that re-adds `continue-on-error: true` to `visual-diff.yml`; confirm it red-X's. (Skip if confident in the grep.) ## Convoy state - Brief 1: SHIPPED (PR #138, `c100c5f`, 2026-06-13) - Baseline refresh: SHIPPED (PR #139, `54495fe`, 2026-06-13) - Brief 2 (this PR): shipping - Convoy closeout: this PR's merge Co-authored-by: Cursor <cursoragent@cursor.com>
503 lines
22 KiB
YAML
503 lines
22 KiB
YAML
name: CI
|
|
|
|
# Vercel variant: Vercel builds Preview deployments on every push and gates the
|
|
# PR via the Vercel GitHub integration check. Running `npm run build` here too
|
|
# would duplicate Vercel's work for ~3-5 minutes per PR with no added signal.
|
|
#
|
|
# What this CI covers (and Vercel does not):
|
|
# - Lint (cheap belt-and-suspenders)
|
|
# - Schema-map drift check (docs/SCHEMA_MAP.md updated when scripts/add-*.js changes)
|
|
# - Migrations apply cleanly (node-pg-migrate against ephemeral Postgres 16)
|
|
# - Unit tests (vitest)
|
|
#
|
|
# NOTE: tcg-vault is JavaScript (not TypeScript). No `npx tsc --noEmit` step.
|
|
# Re-enable a type-check job if migrating to TypeScript.
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
# Skip CI entirely for doc-only PRs. The `slash-ci-minutes` convoy
|
|
# (2026-06-04) added this filter because every grep / lint / vitest /
|
|
# migrate job that fires on a pure-docs PR (e.g. `.convoys/` seeds +
|
|
# briefs, AGENTS.md edits, `docs/`) costs GitHub Actions minutes for
|
|
# zero signal. The full job set still runs on code-touching PRs.
|
|
paths-ignore:
|
|
- '.convoys/**'
|
|
- '**/*.md'
|
|
- 'docs/**'
|
|
- 'AGENTS.md'
|
|
- '.cursor/**'
|
|
- 'README.md'
|
|
push:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- '.convoys/**'
|
|
- '**/*.md'
|
|
- 'docs/**'
|
|
- 'AGENTS.md'
|
|
- '.cursor/**'
|
|
- 'README.md'
|
|
|
|
concurrency:
|
|
group: ci-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
NODE_VERSION: '20'
|
|
|
|
jobs:
|
|
lint:
|
|
name: Lint
|
|
runs-on: [self-hosted, axiom]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
cache: npm
|
|
# Cache node_modules between runs (in addition to setup-node's npm
|
|
# cache). `setup-node@v4`'s `cache: npm` caches `~/.npm` but `npm
|
|
# ci` still does a fresh install into `node_modules` — that's the
|
|
# ~30-45s we want to skip on cache hit. Keyed by package-lock.json
|
|
# hash so any dep change invalidates correctly.
|
|
- name: Cache node_modules
|
|
id: cache-node-modules
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: node_modules
|
|
key: node-modules-${{ runner.os }}-node${{ env.NODE_VERSION }}-${{ hashFiles('package-lock.json') }}
|
|
- run: npm ci
|
|
if: steps.cache-node-modules.outputs.cache-hit != 'true'
|
|
- run: npm run lint --if-present
|
|
|
|
schema-map-fresh:
|
|
name: Schema map up to date
|
|
runs-on: [self-hosted, axiom]
|
|
# Only run when migration scripts or the schema map itself changed.
|
|
# If neither changed, nothing to verify.
|
|
if: |
|
|
contains(github.event.pull_request.changed_files, 'scripts/add-') ||
|
|
contains(github.event.pull_request.changed_files, 'scripts/fix-') ||
|
|
contains(github.event.pull_request.changed_files, 'scripts/setup-neon-db.js') ||
|
|
contains(github.event.pull_request.changed_files, 'migrations/') ||
|
|
contains(github.event.pull_request.changed_files, 'docs/SCHEMA_MAP.md')
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 2
|
|
- name: Verify schema map updated alongside migration scripts
|
|
run: |
|
|
MIGRATION_CHANGED=false
|
|
MAP_CHANGED=false
|
|
if git diff --name-only HEAD~1 | grep -qE '^scripts/(add-|fix-|setup-neon-db\.js)'; then
|
|
MIGRATION_CHANGED=true
|
|
fi
|
|
if git diff --name-only HEAD~1 | grep -qE '^migrations/'; then
|
|
MIGRATION_CHANGED=true
|
|
fi
|
|
if git diff --name-only HEAD~1 | grep -q '^docs/SCHEMA_MAP\.md$'; then
|
|
MAP_CHANGED=true
|
|
fi
|
|
if [ "$MIGRATION_CHANGED" = "true" ] && [ "$MAP_CHANGED" = "false" ]; then
|
|
echo "::error::A migration script changed but docs/SCHEMA_MAP.md was not updated."
|
|
echo "Update docs/SCHEMA_MAP.md to reflect the schema change, then re-push."
|
|
exit 1
|
|
fi
|
|
echo "OK: schema map and migration scripts are in sync."
|
|
|
|
# Consolidated grep-based regression gates. Previously 6 separate jobs
|
|
# (forbidden-endpoints / -cors-headers / -client-side-llm-keys /
|
|
# -modal-shell-without-primitive / -deprecated-color-aliases /
|
|
# -stale-strings); the `slash-ci-minutes` convoy (2026-06-04) merged
|
|
# them into one job to amortize a single actions/checkout across all
|
|
# 6 checks. Each check still emits `::error file=...::msg` so the
|
|
# in-file annotations work the same way. The job uses a FAIL flag so
|
|
# ALL violations across all 6 checks are reported in a single run
|
|
# (matches the previous independent-jobs behavior; nicer than
|
|
# stop-at-first-failure).
|
|
forbidden-patterns:
|
|
name: Forbidden patterns (9 checks)
|
|
runs-on: [self-hosted, axiom]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Run all forbidden-pattern checks
|
|
run: |
|
|
FAIL=0
|
|
|
|
# ---------- (1) No dev endpoints in pages/api ----------
|
|
echo "::group::Check 1/9: No dev endpoints in pages/api"
|
|
BAD_PATHS=(
|
|
"pages/api/simple.js"
|
|
"pages/api/test-auth.js"
|
|
"pages/api/test-db.js"
|
|
"pages/api/setup-database.js"
|
|
)
|
|
FOUND=()
|
|
for path in "${BAD_PATHS[@]}"; do
|
|
if [ -f "$path" ]; then
|
|
FOUND+=("$path")
|
|
fi
|
|
done
|
|
while IFS= read -r path; do
|
|
FOUND+=("$path")
|
|
done < <(find pages/api -maxdepth 4 -type f -name 'test-*.js' 2>/dev/null || true)
|
|
if [ ${#FOUND[@]} -gt 0 ]; then
|
|
echo "::error::Forbidden dev endpoints present in pages/api/. Delete them or move to scripts/."
|
|
for path in "${FOUND[@]}"; do
|
|
echo "::error file=${path}::Forbidden dev endpoint."
|
|
done
|
|
FAIL=1
|
|
else
|
|
echo "OK: no forbidden dev endpoints under pages/api/."
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
# ---------- (2) No wildcard CORS in pages/api ----------
|
|
echo "::group::Check 2/9: No wildcard CORS in pages/api"
|
|
MATCHES=$(grep -rEn 'Access-Control-Allow-(Origin|Methods|Headers)' pages/api/ 2>/dev/null || true)
|
|
if [ -n "$MATCHES" ]; then
|
|
echo "::error::Forbidden CORS headers present under pages/api/. Remove them — same-origin Vercel deployment does not need CORS."
|
|
echo "$MATCHES" | while IFS= read -r line; do
|
|
file=$(echo "$line" | cut -d: -f1)
|
|
lineno=$(echo "$line" | cut -d: -f2)
|
|
echo "::error file=${file},line=${lineno}::Forbidden CORS header — delete this line."
|
|
done
|
|
FAIL=1
|
|
else
|
|
echo "OK: no Access-Control-Allow-* headers under pages/api/."
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
# ---------- (3) No client-side LLM key leakage ----------
|
|
echo "::group::Check 3/9: No client-side LLM key leakage"
|
|
if [ -f pages/api/config/gemini.js ]; then
|
|
echo "::error file=pages/api/config/gemini.js::Forbidden config endpoint — do not return API keys to browsers."
|
|
FAIL=1
|
|
fi
|
|
CONFIG_MATCHES=$(grep -rEn 'apiKey:' pages/api/config/ 2>/dev/null || true)
|
|
if [ -n "$CONFIG_MATCHES" ]; then
|
|
echo "::error::Forbidden apiKey response under pages/api/config/."
|
|
echo "$CONFIG_MATCHES" | while IFS= read -r line; do
|
|
file=$(echo "$line" | cut -d: -f1)
|
|
lineno=$(echo "$line" | cut -d: -f2)
|
|
echo "::error file=${file},line=${lineno}::Do not return API keys from config endpoints."
|
|
done
|
|
FAIL=1
|
|
fi
|
|
AI_OCR_IMPORTS=$(grep -rEn 'from ['\''"].*ai-ocr|import.*ai-ocr' components/ 2>/dev/null || true)
|
|
if [ -n "$AI_OCR_IMPORTS" ]; then
|
|
echo "::error::Browser code must not import lib/ai-ocr — use POST /api/scan/identify instead."
|
|
echo "$AI_OCR_IMPORTS" | while IFS= read -r line; do
|
|
file=$(echo "$line" | cut -d: -f1)
|
|
lineno=$(echo "$line" | cut -d: -f2)
|
|
echo "::error file=${file},line=${lineno}::Remove ai-ocr import; call server-side scan API."
|
|
done
|
|
FAIL=1
|
|
fi
|
|
SERVER_ONLY=(
|
|
lib/scan-vision.js
|
|
)
|
|
LLM_PATTERN='generativelanguage\.googleapis\.com|api\.openai\.com|ai-gateway\.vercel\.sh'
|
|
LLM_FOUND=()
|
|
while IFS= read -r file; do
|
|
skip=false
|
|
for so in "${SERVER_ONLY[@]}"; do
|
|
if [ "$file" = "$so" ]; then
|
|
skip=true
|
|
break
|
|
fi
|
|
done
|
|
if [ "$skip" = true ]; then
|
|
continue
|
|
fi
|
|
if grep -qE "$LLM_PATTERN" "$file" 2>/dev/null; then
|
|
LLM_FOUND+=("$file")
|
|
fi
|
|
done < <(find components lib pages -name '*.js' ! -path 'pages/api/*' 2>/dev/null || true)
|
|
if [ ${#LLM_FOUND[@]} -gt 0 ]; then
|
|
echo "::error::Client-side LLM API URLs must not appear outside pages/api/."
|
|
for path in "${LLM_FOUND[@]}"; do
|
|
echo "::error file=${path}::Move LLM calls server-side or add to server-side-scan-pipeline removal list."
|
|
done
|
|
FAIL=1
|
|
fi
|
|
[ ${#LLM_FOUND[@]} -eq 0 ] && [ -z "$CONFIG_MATCHES" ] && [ -z "$AI_OCR_IMPORTS" ] && [ ! -f pages/api/config/gemini.js ] && echo "OK: no client-side LLM key leakage patterns detected."
|
|
echo "::endgroup::"
|
|
|
|
# ---------- (4) No legacy modal shells ----------
|
|
echo "::group::Check 4/9: No new modal shells without <Modal> primitive"
|
|
MODAL_FOUND=()
|
|
while IFS= read -r file; do
|
|
MODAL_FOUND+=("$file")
|
|
done < <(grep -lE 'fixed inset-0 bg-black bg-opacity-' \
|
|
pages components -r --include='*.js' 2>/dev/null \
|
|
| sort -u || true)
|
|
if [ ${#MODAL_FOUND[@]} -gt 0 ]; then
|
|
echo "::error::Legacy modal-shell pattern detected. Use the <Modal> primitive from components/ui/."
|
|
for f in "${MODAL_FOUND[@]}"; do
|
|
echo "::error file=${f}::Replace 'fixed inset-0 bg-black bg-opacity-' with <Modal open={…} onClose={…} title=…> from components/ui."
|
|
done
|
|
FAIL=1
|
|
else
|
|
echo "OK: no legacy modal shells anywhere in pages/ or components/."
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
# ---------- (5) No deprecated color aliases ----------
|
|
echo "::group::Check 5/9: No use of deprecated color aliases"
|
|
PATTERNS=(
|
|
'gradient-text-purple'
|
|
'gradient-text-pink'
|
|
'gradient-text-blue'
|
|
'glow-purple'
|
|
'glow-pink'
|
|
'glow-blue'
|
|
'gradient-bg-purple'
|
|
'gradient-bg-blue'
|
|
'gradient-bg-pink'
|
|
)
|
|
ALL_MATCHES=""
|
|
for pattern in "${PATTERNS[@]}"; do
|
|
P_MATCHES=$(grep -rFn "$pattern" pages components --include='*.js' 2>/dev/null || true)
|
|
if [ -n "$P_MATCHES" ]; then
|
|
ALL_MATCHES=$(printf '%s\n%s' "$ALL_MATCHES" "$P_MATCHES")
|
|
fi
|
|
done
|
|
if [ -n "$ALL_MATCHES" ]; then
|
|
echo "::error::Deprecated color alias detected. Use --accent-ember / --accent-flame / --accent-gold (or the .gradient-bg-ember / .gradient-text-ember utility classes)."
|
|
echo "$ALL_MATCHES" | sort -u | while IFS= read -r line; do
|
|
[ -z "$line" ] && continue
|
|
file=$(echo "$line" | cut -d: -f1)
|
|
lineno=$(echo "$line" | cut -d: -f2)
|
|
echo "::error file=${file},line=${lineno}::Deprecated color alias — replace with the canonical Deck Hearth warm-palette equivalent."
|
|
done
|
|
FAIL=1
|
|
else
|
|
echo "OK: no deprecated color aliases in pages/ or components/."
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
# ---------- (6) No stale ownership/collection copy ----------
|
|
echo "::group::Check 6/9: No stale ownership/collection copy"
|
|
STRING_PATTERNS=(
|
|
'Mark Owned'
|
|
'Owned Cards'
|
|
'All My Cards'
|
|
)
|
|
STRING_FOUND=()
|
|
for pattern in "${STRING_PATTERNS[@]}"; do
|
|
while IFS= read -r line; do
|
|
STRING_FOUND+=("$line")
|
|
done < <(grep -rFn "$pattern" pages/ components/ \
|
|
--include='*.js' \
|
|
--exclude-dir=api 2>/dev/null || true)
|
|
done
|
|
if [ ${#STRING_FOUND[@]} -gt 0 ]; then
|
|
echo "::error::Forbidden stale UI string(s) in pages/ or components/. Use lib/collection-vocabulary.js labels — see AGENTS.md § Product vocabulary."
|
|
printf '%s\n' "${STRING_FOUND[@]}" | sort -u | while IFS= read -r line; do
|
|
file=$(echo "$line" | cut -d: -f1)
|
|
lineno=$(echo "$line" | cut -d: -f2)
|
|
text=$(echo "$line" | cut -d: -f3-)
|
|
echo "::error file=${file},line=${lineno}::${text}"
|
|
done
|
|
FAIL=1
|
|
else
|
|
echo "OK: no forbidden stale strings in pages/ or components/."
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
# ---------- (7) No bespoke var(--glass-surface-*) inline styles ----------
|
|
echo "::group::Check 7/9: No bespoke var(--glass-surface-*) inline styles"
|
|
# unify-glass-panel-surfaces convoy, Brief 7 (PR sequence after #126).
|
|
# After Briefs 1-6 land, every panel-shaped surface in the app
|
|
# composes via .glass-panel / .glass-panel-strong /
|
|
# .page-header-glass / <GlassSurface>. Bespoke inline-style use
|
|
# of var(--glass-surface-low|mid|high) under pages/ or
|
|
# components/ JSX is the regression vector this gate prevents.
|
|
#
|
|
# Allowlist (explicit, documented exceptions):
|
|
# --- Chrome blocks (D4 of architect plan, ratified) ---
|
|
# - components/ui/GlassSurface.js # the primitive itself
|
|
# - components/Layout.js # sidebar nav-chip chrome (L850 area)
|
|
# - components/ui/TopSearchBar.js # <header> chrome
|
|
#
|
|
# The pending-migration entries (Button / Input /
|
|
# MobileNavigation) were removed by the
|
|
# migrate-button-input-mobilenav-to-glass-primitive convoy
|
|
# (2026-06-05). Adding a fourth chrome-tier entry is a
|
|
# design-system decision — open a new convoy.
|
|
GLASS_ALLOWLIST=(
|
|
"components/ui/GlassSurface.js"
|
|
"components/Layout.js"
|
|
"components/ui/TopSearchBar.js"
|
|
)
|
|
GLASS_FOUND=()
|
|
while IFS= read -r file; do
|
|
skip=false
|
|
for allowed in "${GLASS_ALLOWLIST[@]}"; do
|
|
if [ "$file" = "$allowed" ]; then
|
|
skip=true
|
|
break
|
|
fi
|
|
done
|
|
if [ "$skip" = true ]; then
|
|
continue
|
|
fi
|
|
GLASS_FOUND+=("$file")
|
|
done < <(grep -lE "var\\(--glass-surface-(low|mid|high)\\)" \
|
|
pages components -r --include='*.js' 2>/dev/null \
|
|
| sort -u || true)
|
|
if [ ${#GLASS_FOUND[@]} -gt 0 ]; then
|
|
echo "::error::Bespoke var(--glass-surface-*) inline styles detected outside the documented allowlist."
|
|
echo "Use .glass-panel / .glass-panel-strong / .page-header-glass or compose <GlassSurface> from components/ui/ instead."
|
|
for f in "${GLASS_FOUND[@]}"; do
|
|
echo "::error file=${f}::Replace inline var(--glass-surface-*) with the appropriate class or primitive."
|
|
done
|
|
FAIL=1
|
|
else
|
|
echo "OK: no bespoke glass-surface inline styles outside the allowlist."
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
# ---------- (8) No drift back to `runs-on: ubuntu-latest` ----------
|
|
# migrate-ci-to-self-hosted convoy, Brief 3 (2026-06-05). After
|
|
# Brief 1+2 moved 4 of 5 workflows to `[self-hosted, axiom]` on
|
|
# CT 111, this check is the regression gate: anything other than
|
|
# `agent-context-drift.yml` reintroducing `runs-on: ubuntu-latest`
|
|
# silently re-bills GitHub Actions minutes.
|
|
#
|
|
# Allowlist (single entry, explicit):
|
|
# - .github/workflows/agent-context-drift.yml
|
|
# That file's weekly cron stays on `ubuntu-latest` per Decision D4
|
|
# of the convoy: trading ~2 min/month of billed CI for resilience
|
|
# so the cron runs even when axiom is down for maintenance.
|
|
#
|
|
# Operator override: if you DO need to add a fourth always-billed
|
|
# workflow (rare — discuss it in a convoy first), append the file
|
|
# to RUNS_ON_ALLOWLIST below in the same PR.
|
|
echo "::group::Check 8/9: No drift back to runs-on: ubuntu-latest outside agent-context-drift.yml"
|
|
RUNS_ON_ALLOWLIST=(
|
|
".github/workflows/agent-context-drift.yml"
|
|
)
|
|
RUNS_ON_FOUND=()
|
|
while IFS= read -r match; do
|
|
file=$(echo "$match" | cut -d: -f1)
|
|
skip=false
|
|
for allowed in "${RUNS_ON_ALLOWLIST[@]}"; do
|
|
if [ "$file" = "$allowed" ]; then
|
|
skip=true
|
|
break
|
|
fi
|
|
done
|
|
if [ "$skip" = true ]; then
|
|
continue
|
|
fi
|
|
RUNS_ON_FOUND+=("$match")
|
|
done < <(grep -rEn '^\s*runs-on:\s*ubuntu-latest' .github/workflows/ 2>/dev/null || true)
|
|
if [ ${#RUNS_ON_FOUND[@]} -gt 0 ]; then
|
|
echo "::error::Forbidden \`runs-on: ubuntu-latest\` outside the documented allowlist (currently agent-context-drift.yml only). Use \`runs-on: [self-hosted, axiom]\` to keep CI on the homelab pool (CT 111). See .convoys/migrate-ci-to-self-hosted.md and AGENTS.md § 7 for the revert path if axiom is down."
|
|
for match in "${RUNS_ON_FOUND[@]}"; do
|
|
file=$(echo "$match" | cut -d: -f1)
|
|
lineno=$(echo "$match" | cut -d: -f2)
|
|
echo "::error file=${file},line=${lineno}::Replace with [self-hosted, axiom] or add this file to the RUNS_ON_ALLOWLIST in ci.yml."
|
|
done
|
|
FAIL=1
|
|
else
|
|
echo "OK: no drift to ubuntu-latest outside the allowlist."
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
# ---------- (9) No regression of visual-diff merge gate ----------
|
|
# `harden-visual-diff-gate` brief 2 (PR #140) removed
|
|
# `continue-on-error: true` from `visual-diff.yml`'s screenshot
|
|
# capture step, making visual diff a real merge gate. This check
|
|
# guards against the flag being re-introduced (intentionally or
|
|
# by template-revert) and silently downgrading the gate to
|
|
# advisory again.
|
|
#
|
|
# Scoped narrowly to visual-diff.yml — other workflows
|
|
# legitimately use `continue-on-error: true` (e.g. preview-smoke
|
|
# could choose to in a future advisory mode).
|
|
echo "::group::Check 9/9: No continue-on-error in visual-diff.yml"
|
|
if grep -qE '^\s*continue-on-error:\s*true' .github/workflows/visual-diff.yml 2>/dev/null; then
|
|
echo "::error file=.github/workflows/visual-diff.yml::Forbidden \`continue-on-error: true\` re-introduced to visual-diff.yml. The screenshot-capture step is a hard merge gate post-harden-visual-diff-gate brief 2. To intentionally downgrade the gate, open a convoy and document the rollback in AGENTS.md § Testing § Screenshot diff."
|
|
FAIL=1
|
|
else
|
|
echo "OK: visual-diff.yml has no continue-on-error: true."
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
# ---------- Final exit ----------
|
|
if [ "$FAIL" -ne 0 ]; then
|
|
echo "::error::One or more forbidden-pattern checks failed. See annotations above."
|
|
exit 1
|
|
fi
|
|
echo "All 9 forbidden-pattern checks passed."
|
|
|
|
migrate:
|
|
name: Migrations apply (node-pg-migrate)
|
|
runs-on: [self-hosted, axiom]
|
|
# Postgres lives on CT 102 (axiom homelab). Per-run database keeps parallel
|
|
# PRs isolated and a `DROP DATABASE` in `always()` keeps the catalog tidy.
|
|
# `HOMELAB_CI_POSTGRES_PASSWORD` is a repo secret — password only. The
|
|
# `deckhearth_ci` Postgres role has CREATEDB but no superuser; a
|
|
# compromised runner can't reach other apps' databases.
|
|
#
|
|
# psql picks PGHOST/PGUSER/PGPASSWORD/PGPORT up automatically, so we
|
|
# don't build a URL and we sidestep any URL-parsing quirks around
|
|
# special chars in the connection string.
|
|
env:
|
|
PGHOST: 192.168.68.102
|
|
PGPORT: '5432'
|
|
PGUSER: deckhearth_ci
|
|
PGPASSWORD: ${{ secrets.HOMELAB_CI_POSTGRES_PASSWORD }}
|
|
DBNAME: ci_run_${{ github.run_id }}_${{ github.run_attempt }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
cache: npm
|
|
- name: Install postgresql-client
|
|
# myoung34/github-runner image doesn't ship psql. ~10s on first
|
|
# apt-update; the underlying apt cache survives between runs because
|
|
# the ephemeral runner container is recreated but layers are cached
|
|
# by the CT's docker daemon.
|
|
run: sudo apt-get update -qq && sudo apt-get install -y -qq postgresql-client
|
|
- name: Cache node_modules
|
|
id: cache-node-modules
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: node_modules
|
|
key: node-modules-${{ runner.os }}-node${{ env.NODE_VERSION }}-${{ hashFiles('package-lock.json') }}
|
|
- run: npm ci
|
|
if: steps.cache-node-modules.outputs.cache-hit != 'true'
|
|
- name: Create per-run database
|
|
run: |
|
|
psql -d postgres -c "CREATE DATABASE \"$DBNAME\";"
|
|
echo "POSTGRES_URL=postgres://$PGUSER:$PGPASSWORD@$PGHOST:$PGPORT/$DBNAME" >> .env.local
|
|
- run: npm run migrate up
|
|
- name: Drop per-run database
|
|
if: always()
|
|
run: psql -d postgres -c "DROP DATABASE IF EXISTS \"$DBNAME\";"
|
|
|
|
test:
|
|
name: Unit tests (vitest)
|
|
runs-on: [self-hosted, axiom]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
cache: npm
|
|
- name: Cache node_modules
|
|
id: cache-node-modules
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: node_modules
|
|
key: node-modules-${{ runner.os }}-node${{ env.NODE_VERSION }}-${{ hashFiles('package-lock.json') }}
|
|
- run: npm ci
|
|
if: steps.cache-node-modules.outputs.cache-hit != 'true'
|
|
- run: npm run test:run
|
|
env:
|
|
JWT_SECRET: ci-secret-only-for-tests-do-not-use-in-prod
|