mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-08-11 00:30:12 -04:00
7f1e249849
Frontend:
- react-router/-dom 7.18.1 -> 7.18.2. The RSC-mode CSRF advisory was carried
as a documented exception in the audit gate because its only fix was the
8.3.0 major; upstream backported it, so the exemption lapsed on its own --
an entry only holds while fixAvailable.isSemVerMajor is true. The allowlist
is now empty; the machinery stays for the next one.
- dompurify 3.4.12 -> 3.4.13. Ships in the app, but the path is unreachable:
no hooks registered, IN_PLACE never used.
- js-yaml override ^4.3.0 -> ^5.2.3 (fix not backported below 5.x, so a
major) and nanoid override ^3.3.18. Both dev-only, via eslint and postcss.
eslintrc calls only load(), on the legacy .eslintrc.yml path this repo does
not use; eslint, vite build and 2861 frontend tests pass on it.
Backend:
- cryptography >=48.0.1 -> >=50.0.0, aiohttp >=3.14.0 -> >=3.14.3, pyopenssl
>=26.3.0 -> >=26.4.0. CI resolves from scratch and was already installing
the fixed releases; the floors cover the case CI does not, an existing venv
where >= is satisfied and `pip install -r` upgrades nothing. pyOpenSSL has
to move with cryptography -- each release caps it to a narrow window, so a
stale pyOpenSSL pins cryptography below its own fix line.
434 lines
16 KiB
YAML
434 lines
16 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
# Run on PRs targeting main, but skip for repo owner (runs local tests)
|
|
|
|
# Skip CI for PRs authored by repo owner (they run tests locally)
|
|
# Uses PR author instead of triggering actor so rebasing by owner doesn't skip CI
|
|
|
|
env:
|
|
PYTHON_VERSION: '3.11'
|
|
NODE_VERSION: '22'
|
|
|
|
# Cancel in-progress runs for the same branch
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
# Minimum permissions for all jobs
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
# ============================================================================
|
|
# Backend Checks
|
|
# ============================================================================
|
|
|
|
backend-lint:
|
|
name: Backend Lint
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v6
|
|
with:
|
|
python-version: ${{ env.PYTHON_VERSION }}
|
|
|
|
- name: Install ruff
|
|
# Install the exact pin from requirements-dev.txt rather than the latest
|
|
# release, so CI and contributors run the same linter. `pip install ruff`
|
|
# silently drifted ahead of every local venv.
|
|
run: pip install "$(grep -E '^ruff==' requirements-dev.txt)"
|
|
|
|
- name: Run ruff check
|
|
run: ruff check backend/
|
|
|
|
- name: Run ruff format check
|
|
run: ruff format --check backend/
|
|
|
|
backend-security:
|
|
name: Backend Security
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v6
|
|
with:
|
|
python-version: ${{ env.PYTHON_VERSION }}
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
# Upgrade setuptools too: the runner's Python toolcache ships an old
|
|
# setuptools that trips pip-audit (PYSEC-2026-3447, fixed in 83.0.0).
|
|
# A fix exists, so we upgrade rather than --ignore-vuln.
|
|
python -m pip install --upgrade pip setuptools
|
|
pip install -r requirements.txt
|
|
pip install pip-audit
|
|
|
|
- name: Run pip-audit
|
|
run: |
|
|
# CVE-2026-4539: low-severity ReDoS in Pygments AdlLexer (indirect dep via mkdocs-material/pytest/rich).
|
|
# No fix available yet. Remove --ignore-vuln once Pygments releases a patched version.
|
|
#
|
|
# CVE-2025-45768 (PYSEC-2025-183 / GHSA-65pc-fj4g-8rjx): disputed by PyJWT maintainers.
|
|
# Advisory says "key length is chosen by the application that uses the library" — no
|
|
# PyJWT fix exists or will exist. Bambuddy is safe: backend/app/core/auth.py:184 uses
|
|
# secrets.token_urlsafe(64) (~86 chars of entropy) for auto-generated secrets and
|
|
# rejects file-loaded secrets shorter than 32 chars at :177. Keep ignored permanently.
|
|
pip-audit --desc on \
|
|
--ignore-vuln CVE-2026-4539 \
|
|
--ignore-vuln CVE-2025-45768
|
|
|
|
backend-tests:
|
|
name: Backend Tests (shard ${{ matrix.shard }}/4)
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
|
|
needs: backend-lint
|
|
strategy:
|
|
# Don't cancel sibling shards if one fails — we want every shard's
|
|
# failure list, not just the first one, so a single PR push shows
|
|
# all broken tests in one go.
|
|
fail-fast: false
|
|
matrix:
|
|
shard: [1, 2, 3, 4]
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v6
|
|
with:
|
|
python-version: ${{ env.PYTHON_VERSION }}
|
|
|
|
- name: Cache pip
|
|
uses: actions/cache@v5
|
|
with:
|
|
path: ~/.cache/pip
|
|
key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-pip-
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
pip install -r requirements.txt
|
|
pip install -r requirements-dev.txt
|
|
|
|
- name: Run tests (shard ${{ matrix.shard }}/4)
|
|
timeout-minutes: 10
|
|
run: |
|
|
cd backend
|
|
# -v dropped: 5300+ "PASSED foo::bar" lines per worker eat 30-60s
|
|
# of stdout I/O time on 2-vCPU runners. --tb=short is enough.
|
|
# --splits 4 --group N uses pytest-split to slice the collected
|
|
# test set roughly evenly across the 4 matrix shards; first run
|
|
# is name-hash-based, subsequent runs improve via .test_durations
|
|
# if you ever commit one (we don't — even the naive hash split
|
|
# gets us ≈25% per shard given the test mix here).
|
|
python -m pytest tests/ \
|
|
--tb=short \
|
|
--timeout=60 --timeout-method=thread \
|
|
-n auto \
|
|
--splits 4 --group ${{ matrix.shard }}
|
|
|
|
# ============================================================================
|
|
# Frontend Checks
|
|
# ============================================================================
|
|
|
|
frontend-lint:
|
|
name: Frontend Lint
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
cache: 'npm'
|
|
cache-dependency-path: frontend/package-lock.json
|
|
|
|
- name: Install dependencies
|
|
working-directory: frontend
|
|
run: npm ci
|
|
|
|
- name: Run ESLint
|
|
working-directory: frontend
|
|
run: npm run lint
|
|
|
|
frontend-security:
|
|
name: Frontend Security
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
cache: 'npm'
|
|
cache-dependency-path: frontend/package-lock.json
|
|
|
|
- name: Install dependencies
|
|
working-directory: frontend
|
|
run: npm ci
|
|
|
|
- name: Run npm audit
|
|
working-directory: frontend
|
|
run: |
|
|
# Only audit production dependencies and filter out npm-internal packages.
|
|
# npm 10.x audit/ls reports vulns in its own bundled deps (npm, tar, minimatch)
|
|
# so we parse package-lock.json directly to get the real prod dep list.
|
|
npm audit --omit=dev --json > /tmp/audit.json 2>/dev/null || true
|
|
python3 -c "
|
|
import json, sys
|
|
data = json.load(open('/tmp/audit.json'))
|
|
lock = json.load(open('package-lock.json'))
|
|
prod = set()
|
|
for path, info in lock.get('packages', {}).items():
|
|
if path and not info.get('dev') and not info.get('devOptional'):
|
|
prod.add(path.split('node_modules/')[-1])
|
|
vulns = data.get('vulnerabilities', {})
|
|
# Documented advisory exceptions: high/critical findings whose only offered
|
|
# 'fix' is a semver-major change and which do not apply to how Bambuddy ships.
|
|
# Keyed by GHSA id. An entry only holds while the fix stays major-only (see
|
|
# fix_is_major below) - once upstream backports, the gate fails until we take
|
|
# the patch. That is what retired the one entry this list used to carry:
|
|
# GHSA-qwww-vcr4-c8h2 (React Router RSC-mode CSRF) shipped in 7.18.2, so the
|
|
# pin moved rather than the exception staying.
|
|
ALLOWLIST = set()
|
|
def advisory_ids(name, seen=None):
|
|
seen = seen if seen is not None else set()
|
|
if name in seen:
|
|
return set()
|
|
seen.add(name)
|
|
ids = set()
|
|
for item in vulns.get(name, {}).get('via', []):
|
|
if isinstance(item, dict):
|
|
url = item.get('url', '')
|
|
if '/advisories/' in url:
|
|
ids.add(url.rsplit('/', 1)[-1])
|
|
elif isinstance(item, str):
|
|
ids |= advisory_ids(item, seen)
|
|
return ids
|
|
def fix_is_major(v):
|
|
fa = v.get('fixAvailable')
|
|
return isinstance(fa, dict) and fa.get('isSemVerMajor')
|
|
def exempt(name, v):
|
|
ids = advisory_ids(name)
|
|
return bool(ids) and ids <= ALLOWLIST and fix_is_major(v)
|
|
fixable = {n: v for n, v in vulns.items()
|
|
if n in prod and v.get('severity') in ('high', 'critical')
|
|
and v.get('fixAvailable') and not exempt(n, v)}
|
|
skipped = len(vulns) - len({n: v for n, v in vulns.items() if n in prod})
|
|
if fixable:
|
|
for name, v in fixable.items():
|
|
print(f'FIXABLE {v[\"severity\"].upper()}: {name}')
|
|
sys.exit(1)
|
|
total = sum(1 for n, v in vulns.items() if n in prod and v.get('severity') in ('high', 'critical'))
|
|
exempted = sorted(n for n, v in vulns.items() if n in prod and exempt(n, v))
|
|
print(f'npm audit: {total} high/critical (0 fixable), {len(vulns)} total ({skipped} npm-internal filtered)')
|
|
if exempted:
|
|
print('exempted (documented, unreachable): ' + ', '.join(exempted))
|
|
"
|
|
|
|
frontend-typecheck:
|
|
name: Frontend Type Check
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
cache: 'npm'
|
|
cache-dependency-path: frontend/package-lock.json
|
|
|
|
- name: Install dependencies
|
|
working-directory: frontend
|
|
run: npm ci
|
|
|
|
- name: Run TypeScript check
|
|
working-directory: frontend
|
|
run: npx tsc --noEmit
|
|
|
|
frontend-tests:
|
|
name: Frontend Tests
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
|
|
needs: [frontend-lint, frontend-typecheck]
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
cache: 'npm'
|
|
cache-dependency-path: frontend/package-lock.json
|
|
|
|
- name: Install dependencies
|
|
working-directory: frontend
|
|
run: npm ci
|
|
|
|
- name: Run tests
|
|
timeout-minutes: 10
|
|
working-directory: frontend
|
|
run: npm run test:run
|
|
|
|
frontend-build:
|
|
name: Frontend Build
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
|
|
needs: [frontend-tests]
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
cache: 'npm'
|
|
cache-dependency-path: frontend/package-lock.json
|
|
|
|
- name: Install dependencies
|
|
working-directory: frontend
|
|
run: npm ci
|
|
|
|
- name: Build
|
|
working-directory: frontend
|
|
run: npm run build
|
|
|
|
# ============================================================================
|
|
# Docker Tests (matches test_docker.sh)
|
|
# ============================================================================
|
|
|
|
# Run the FULL backend test suite inside the test image, sharded 4-way
|
|
# so wall-clock matches the host-side backend-tests job. Catches the
|
|
# rare-but-real cases where a test passes on the GHA host but fails in
|
|
# the python:3.13-slim test image (system-binary version differences,
|
|
# locale/timezone, container vs host user, cwd assumptions). Without
|
|
# sharding this was a 5-10 min single-runner job; with sharding it's
|
|
# ~120-150s per shard running in parallel, gated by max(shard).
|
|
docker-backend-tests:
|
|
name: Docker Backend Tests (shard ${{ matrix.shard }}/4)
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
|
|
timeout-minutes: 15
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
shard: [1, 2, 3, 4]
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v4
|
|
|
|
# Build the backend-test image with GHA BuildKit cache backend so
|
|
# the pip-install layer is shared across the 4 matrix shards AND
|
|
# across CI runs. First run on a given requirements.txt is cold
|
|
# (~60-90s); subsequent runs are ~5-10s.
|
|
- name: Build backend test image (cached)
|
|
uses: docker/build-push-action@v7
|
|
with:
|
|
context: .
|
|
file: Dockerfile.test
|
|
target: backend-test
|
|
load: true
|
|
tags: bambuddy-backend-test:latest
|
|
cache-from: type=gha,scope=backend-test
|
|
cache-to: type=gha,scope=backend-test,mode=max
|
|
|
|
- name: Run backend tests in Docker (shard ${{ matrix.shard }}/4)
|
|
run: |
|
|
docker run --rm \
|
|
-e TESTING=1 \
|
|
-e PYTHONUNBUFFERED=1 \
|
|
bambuddy-backend-test:latest \
|
|
pytest backend/tests/ \
|
|
--tb=short \
|
|
--timeout=60 --timeout-method=thread \
|
|
-p no:cacheprovider \
|
|
-n auto \
|
|
--splits 4 --group ${{ matrix.shard }}
|
|
|
|
docker-test:
|
|
name: Docker Build
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' || github.event.pull_request.user.login != github.repository_owner
|
|
timeout-minutes: 20
|
|
needs: [backend-tests, frontend-build]
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
# Test 1: Docker Build
|
|
- name: Build production image
|
|
run: docker build -t bambuddy:test .
|
|
|
|
- name: Verify backend imports
|
|
run: docker run --rm bambuddy:test python -c "import backend.app.main; print('Backend imports OK')"
|
|
|
|
- name: Verify static files exist
|
|
run: docker run --rm bambuddy:test test -d /app/static
|
|
|
|
# Test 4: Integration Tests
|
|
- name: Build integration container
|
|
run: docker compose -f docker-compose.test.yml build integration
|
|
|
|
- name: Start integration container
|
|
run: |
|
|
docker compose -f docker-compose.test.yml up -d integration
|
|
echo "Waiting for container to be healthy..."
|
|
for i in {1..30}; do
|
|
if docker compose -f docker-compose.test.yml ps integration | grep -q "healthy"; then
|
|
echo "Container is healthy"
|
|
break
|
|
fi
|
|
sleep 2
|
|
done
|
|
|
|
- name: Test health endpoint
|
|
run: |
|
|
HEALTH=$(docker compose -f docker-compose.test.yml exec -T integration curl -s http://localhost:8000/health)
|
|
echo "$HEALTH"
|
|
echo "$HEALTH" | grep -q "healthy"
|
|
|
|
- name: Test API endpoint
|
|
run: |
|
|
docker compose -f docker-compose.test.yml exec -T integration curl -s http://localhost:8000/api/v1/settings
|
|
|
|
- name: Test static files served
|
|
run: |
|
|
STATUS=$(docker compose -f docker-compose.test.yml exec -T integration curl -s -o /dev/null -w "%{http_code}" http://localhost:8000/)
|
|
echo "Static files HTTP status: $STATUS"
|
|
[ "$STATUS" = "200" ]
|
|
|
|
# Test 5: Integration Test Suite (pytest)
|
|
- name: Build integration test runner
|
|
run: docker compose -f docker-compose.test.yml build integration-test-runner
|
|
|
|
- name: Run integration test suite
|
|
run: docker compose -f docker-compose.test.yml run --rm integration-test-runner
|
|
|
|
- name: Show logs on failure
|
|
if: failure()
|
|
run: docker compose -f docker-compose.test.yml logs
|
|
|
|
- name: Cleanup
|
|
if: always()
|
|
run: docker compose -f docker-compose.test.yml down -v --remove-orphans
|