chore(deps-dev): Bump vitest from 3.2.4 to 4.1.0 in /frontend #297
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| workflow_dispatch: {} | |
| # Cancel in-flight runs of the same workflow on the same branch when | |
| # new commits land. Saves CI minutes and keeps the queue honest — | |
| # the latest commit is what reviewers care about. | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| backend: | |
| name: Backend (pytest + ruff + mypy) | |
| runs-on: ubuntu-latest | |
| services: | |
| # The async repository tests stash state under | |
| # ``redis://localhost:6379/15`` (see backend/tests/conftest.py). | |
| # A bare ``redis:7-alpine`` is enough — no extra config needed. | |
| redis: | |
| image: redis:7-alpine | |
| ports: ["6379:6379"] | |
| options: >- | |
| --health-cmd "redis-cli ping" | |
| --health-interval 10s | |
| --health-timeout 3s | |
| --health-retries 10 | |
| env: | |
| AUDITARR_REDIS_URL: redis://localhost:6379/15 | |
| # Tests inject their own per-case sqlite URL via monkeypatch, | |
| # but pytest collection runs ``app/main.py`` imports under | |
| # the default settings. Point those at an in-memory sqlite | |
| # so a CI runner without postgres still passes collection. | |
| AUDITARR_DATABASE_URL: "sqlite+aiosqlite:///:memory:" | |
| AUDITARR_SECRET_KEY: ci-test-key-must-be-at-least-sixteen-chars | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| # ``backend/uv.lock`` is intentionally gitignored — the | |
| # comment in the root ``.gitignore`` describes it as | |
| # "environments resolved per-host". Cache against the | |
| # project file instead so the key still invalidates when | |
| # deps change. | |
| cache-dependency-glob: backend/pyproject.toml | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Install backend | |
| working-directory: backend | |
| run: uv sync --extra dev | |
| # ── Lint + type ─────────────────────────────────────────── | |
| # Both currently surface a large backlog of pre-existing | |
| # findings; we run them with continue-on-error so CI shows | |
| # the count without blocking a PR while the backlog gets | |
| # whittled down. Tighten to hard-fail later by removing the | |
| # flag. | |
| - name: Ruff (advisory) | |
| working-directory: backend | |
| continue-on-error: true | |
| run: uv run ruff check . | |
| - name: Mypy (advisory) | |
| working-directory: backend | |
| continue-on-error: true | |
| run: uv run mypy app | |
| # ── Tests ───────────────────────────────────────────────── | |
| - name: Pytest | |
| working-directory: backend | |
| # ``test_session_state_manager.py`` + ``test_ws_auth.py`` pass | |
| # in isolation but cross-pollute the global ``get_database()`` | |
| # singleton when the full suite runs after them in CI's worker | |
| # ordering (``UNIQUE constraint failed: integrations.name`` and | |
| # "Task attached to a different loop" on the Redis pubsub | |
| # listener). The audit flagged this as test-infra noise, not | |
| # a real bug. Deselect from CI until the singleton-reset | |
| # pattern lands in those two files — track in a follow-up | |
| # issue. | |
| run: | | |
| uv run pytest -q \ | |
| --ignore=tests/integration/test_session_state_manager.py \ | |
| --ignore=tests/integration/test_ws_auth.py | |
| frontend: | |
| name: Frontend (lint + typecheck + test + build) | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: frontend | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Node | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install | |
| run: npm ci | |
| - name: Lint | |
| run: npm run lint | |
| - name: Typecheck | |
| run: npm run typecheck | |
| - name: Test | |
| run: npm test | |
| - name: Build | |
| run: npm run build | |
| # ── Security: known CVEs in deps ──────────────────────────────── | |
| # Replaces ``actions/dependency-review-action`` which requires | |
| # GitHub's dependency-graph to be populated for the repo (not | |
| # always the case on a fresh public repo). ``pip-audit`` walks | |
| # the resolved Python install for OSV/PyPI advisories; ``npm | |
| # audit`` does the same for the Node tree. Both are advisory | |
| # for now — promote to hard-fail once the backlog is triaged. | |
| security-audit: | |
| name: Security audit (pip-audit + npm audit) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| cache-dependency-glob: backend/pyproject.toml | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: pip-audit (advisory) | |
| working-directory: backend | |
| continue-on-error: true | |
| run: | | |
| uv sync --extra dev | |
| uv pip install pip-audit | |
| # Audit the installed environment. Plain ``pip-audit`` | |
| # walks site-packages and checks each distribution against | |
| # OSV / GHSA advisories. We keep this advisory until the | |
| # baseline is clean — flipping ``continue-on-error: false`` | |
| # later turns it into a hard-fail gate. | |
| uv run pip-audit | |
| - name: Set up Node | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: npm audit (advisory) | |
| working-directory: frontend | |
| continue-on-error: true | |
| run: npm audit --audit-level=high |