mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 20:42:43 +00:00
Marc-André Bombeck
d7bf0df10b
Every workflow action is pinned to a commit SHA, dependabot auto-merge is limited to patch and minor updates behind the now-required status checks on main, and the audit, Trivy and ESLint gates block instead of warning. The published image finally carries its build SHA and build timestamp so the version endpoint can prove which commit is running. The API-token HMAC key fails closed under 32 characters, compose pins the database minor and denies privilege escalation, and the changelog drops working-note references in favour of neutral wording.
44 lines
1.4 KiB
YAML
44 lines
1.4 KiB
YAML
name: Integration tests
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
integration:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
|
|
|
|
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- run: pnpm db:generate
|
|
|
|
- run: pnpm test:integration
|
|
env:
|
|
# The integration suite boots a Postgres testcontainer and points
|
|
# Prisma at it via DATABASE_URL set inside `tests/integration/setup.ts`.
|
|
# These env vars satisfy code paths that read them at module load.
|
|
#
|
|
# ENCRYPTION_KEY MUST be quoted: YAML 1.2 parses an unquoted run of
|
|
# zeros as the integer 0, which then arrives in `process.env` as the
|
|
# string "0" — failing crypto's hex/base64 length check and breaking
|
|
# the backups + integration-status suites for 50+ runs (regression
|
|
# since v1.4.13). Quoting forces a literal scalar.
|
|
API_TOKEN_HMAC_KEY: "integration-tests-do-not-use-in-prod"
|
|
ENCRYPTION_KEY: "0000000000000000000000000000000000000000000000000000000000000000"
|
|
SESSION_SECRET: "integration-tests"
|