Skip to content

Commit d40d93a

Browse files
gwleclercgwleclerc
authored
Merge branch 'main' into add-newbodymatcher
2 parents 0a6f43e + 1eed302 commit d40d93a

109 files changed

Lines changed: 14104 additions & 12659 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.eslintignore‎

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎.eslintrc.yml‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎.github/dependabot.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
version: 2
2+
updates:
3+
# Keep the SHA-pinned GitHub Actions current (Dependabot rewrites the pin and its
4+
# version comment). Grouped so all bumps arrive in a single PR.
5+
- package-ecosystem: github-actions
6+
directory: /
7+
schedule:
8+
interval: weekly
9+
groups:
10+
github-actions:
11+
patterns:
12+
- "*"
13+
14+
# Go module dependencies.
15+
- package-ecosystem: gomod
16+
directory: /
17+
schedule:
18+
interval: weekly
19+
groups:
20+
gomod:
21+
patterns:
22+
- "*"
23+
24+
# Frontend (npm) dependencies.
25+
- package-ecosystem: npm
26+
directory: /
27+
schedule:
28+
interval: weekly
29+
groups:
30+
npm:
31+
patterns:
32+
- "*"

‎.github/workflows/main.yml‎

Lines changed: 145 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -3,141 +3,219 @@ on:
33
push:
44
branches:
55
- main
6+
# Release flavor is derived from the tag suffix in the deploy job. Convention: prefix tags
7+
# with "v" (bare X.Y.Z is still accepted for backward compatibility).
68
tags:
7-
- '*.*.*' # semver, will override latest
8-
- '*-preview' # preview, won't override latest
9+
- '*.*.*' # stable semver (e.g. v1.2.3): published and marked "Latest"
10+
- '*-preview' # pre-release (e.g. v1.2.3-preview): published, never "Latest"
11+
- '*-draft' # draft (e.g. v1.2.3-draft): unpublished for review, never "Latest"
912
pull_request:
1013
branches:
1114
- main
1215
workflow_dispatch: # Allow manual trigger
1316

17+
# Least privilege by default; the deploy job elevates it explicitly.
1418
permissions:
15-
contents: write
16-
packages: write
19+
contents: read
20+
21+
# Cancel superseded runs on the same ref, but only for pull requests — never abort an in-flight
22+
# push to main or a tag (which may be mid-release).
23+
concurrency:
24+
group: ${{ github.workflow }}-${{ github.ref }}
25+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
1726

1827
jobs:
1928
lint:
2029
runs-on: ubuntu-latest
2130
timeout-minutes: 5
2231
steps:
23-
- uses: actions/checkout@v4
24-
25-
- uses: actions/setup-node@v4
32+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
33+
with:
34+
persist-credentials: false
35+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
2636
with:
2737
node-version-file: .nvmrc
28-
cache: yarn
29-
30-
- run: yarn install --frozen-lockfile
31-
38+
cache: npm
39+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
40+
with:
41+
go-version-file: go.mod
42+
- run: npm ci
3243
- name: Lint sources
3344
run: |
3445
make lint
35-
yarn lint
46+
npm run lint
3647
3748
test:
3849
runs-on: ubuntu-latest
3950
timeout-minutes: 5
4051
steps:
41-
- uses: actions/checkout@v4
52+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
4253
with:
43-
fetch-depth: 0
44-
45-
- uses: actions/setup-node@v4
54+
fetch-depth: 0 # SonarCloud needs the full history for blame/coverage
55+
persist-credentials: false
56+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
4657
with:
4758
node-version-file: .nvmrc
48-
cache: yarn
49-
50-
51-
- name: Setup Go environment
52-
uses: actions/setup-go@v5
59+
cache: npm
60+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
5361
with:
54-
go-version: stable
55-
56-
- run: yarn install --frozen-lockfile
57-
62+
go-version-file: go.mod
63+
- run: npm ci
5864
- name: Execute tests
5965
run: |
6066
make test
6167
make test-integration
62-
yarn test
68+
npm test
6369
make coverage
64-
6570
- name: SonarCloud Scan
66-
uses: sonarsource/sonarcloud-github-action@master
71+
uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
6772
continue-on-error: true
6873
env:
6974
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
7075
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
7176

72-
build:
77+
e2e:
7378
runs-on: ubuntu-latest
74-
timeout-minutes: 5
79+
timeout-minutes: 10
7580
steps:
76-
- uses: actions/checkout@v4
77-
78-
- id: extract_ref
79-
run: echo ::set-output name=GIT_REF::$(echo ${GITHUB_REF##*/})
80-
81-
- uses: actions/setup-node@v4
81+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
82+
with:
83+
persist-credentials: false
84+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
8285
with:
8386
node-version-file: .nvmrc
84-
cache: yarn
85-
86-
- name: Setup Go environment
87-
uses: actions/setup-go@v5
87+
cache: npm
88+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
89+
with:
90+
go-version-file: go.mod
91+
- run: npm ci
92+
- name: Install Playwright browser
93+
run: npx playwright install --with-deps chromium
94+
- name: Run Playwright non-regression suite
95+
run: make test-e2e
96+
97+
security:
98+
runs-on: ubuntu-latest
99+
timeout-minutes: 10
100+
steps:
101+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
102+
with:
103+
persist-credentials: false
104+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
88105
with:
89-
go-version: stable
106+
node-version-file: .nvmrc
107+
cache: npm
108+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
109+
with:
110+
go-version-file: go.mod
111+
# Audit only the dependencies that ship in the client bundle (dev tooling isn't served), and
112+
# fail only on high/critical advisories.
113+
- name: Audit frontend dependencies (npm)
114+
run: npm audit --omit=dev --audit-level=high
115+
# govulncheck reports only vulnerabilities actually reachable from the code, so it's low-noise
116+
# and safe to gate on.
117+
- name: Scan backend dependencies (govulncheck)
118+
run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
90119

91-
- run: yarn install --frozen-lockfile
120+
build:
121+
runs-on: ubuntu-latest
122+
timeout-minutes: 10
123+
steps:
124+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
125+
with:
126+
persist-credentials: false
127+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
128+
with:
129+
node-version-file: .nvmrc
130+
cache: npm
131+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
132+
with:
133+
go-version-file: go.mod
92134

93-
- name: Build
135+
# Every run assembles the native image and smoke-tests it (proves the Dockerfile + embedded
136+
# UI still work). Only tag builds also cross-compile the release binaries + tarball, which the
137+
# deploy job packages into the multi-arch image and the GitHub release.
138+
- name: Build image (+ release binaries on tags) and smoke-test
139+
env:
140+
VERSION: ${{ github.ref_name }}
94141
run: |
95-
make VERSION=${{ steps.extract_ref.outputs.GIT_REF }} RELEASE=1 release
96-
make VERSION=${{ steps.extract_ref.outputs.GIT_REF }} build-docker
97-
make VERSION=${{ steps.extract_ref.outputs.GIT_REF }} start-docker
142+
targets="build-docker start-docker smoke-docker"
143+
[[ "$GITHUB_REF" == refs/tags/* ]] && targets="release $targets"
144+
make VERSION="$VERSION" RELEASE=1 $targets
98145
99-
- if: startsWith(github.ref, 'refs/tags/')
100-
uses: actions/upload-artifact@v4
146+
- name: Upload release artifacts
147+
if: startsWith(github.ref, 'refs/tags/')
148+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
101149
with:
102-
name: smocker-bin
103-
path: ./build/smocker.tar.gz
150+
name: smocker-dist
151+
path: |
152+
build/smocker.tar.gz
153+
build/smocker-*
104154
105155
deploy:
106-
needs: [lint, test, build]
156+
needs: [lint, test, build, e2e, security]
107157
if: startsWith(github.ref, 'refs/tags/')
108158
runs-on: ubuntu-latest
109159
timeout-minutes: 10
160+
# Elevated only here: push the image to GHCR and publish the GitHub release.
161+
permissions:
162+
contents: write
163+
packages: write
110164
steps:
111-
- uses: actions/checkout@v4
112-
113-
- id: extract_ref
114-
run: echo ::set-output name=GIT_REF::$(echo ${GITHUB_REF##*/})
165+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
166+
with:
167+
persist-credentials: false
115168

116-
- uses: actions/download-artifact@v4
169+
- id: release_flags
170+
name: Derive the release flavor from the tag suffix
171+
env:
172+
REF: ${{ github.ref_name }}
173+
run: |
174+
draft=false
175+
prerelease=false
176+
make_latest=true
177+
if [[ "$REF" == *-draft ]]; then
178+
draft=true # unpublished, editable on GitHub before release
179+
make_latest=false
180+
elif [[ "$REF" == *-* ]]; then
181+
prerelease=true # e.g. -preview / -rc: published but never "Latest"
182+
make_latest=false
183+
fi
184+
{
185+
echo "draft=$draft"
186+
echo "prerelease=$prerelease"
187+
echo "make_latest=$make_latest"
188+
} >> "$GITHUB_OUTPUT"
189+
190+
# The pre-built binaries (+ tarball) from the build job; the image is assembled from them.
191+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
117192
with:
118-
name: smocker-bin
193+
name: smocker-dist
119194
path: ./build
120195

121-
- run: cd build && tar -xvf smocker.tar.gz
122-
123196
- name: Docker login
124-
uses: docker/login-action@v3
197+
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
125198
with:
126199
registry: ghcr.io
127200
username: ${{ github.actor }}
128201
password: ${{ secrets.GITHUB_TOKEN }}
129202

130-
- name: Set up QEMU
131-
uses: docker/setup-qemu-action@v3
132-
203+
# No QEMU: the image only packages the pre-built binaries (COPY-only target stages).
133204
- name: Set up Docker Buildx
134-
uses: docker/setup-buildx-action@v3
205+
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
135206

136207
- name: Deploy on Docker registry
137-
run: make VERSION=${{ steps.extract_ref.outputs.GIT_REF }} deploy-docker
208+
env:
209+
VERSION: ${{ github.ref_name }}
210+
run: make VERSION="$VERSION" deploy-docker
138211

139212
- name: Deploy on GitHub releases
140-
uses: softprops/action-gh-release@v2
213+
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
141214
with:
142-
files: build/smocker.tar.gz
215+
files: |
216+
build/smocker.tar.gz
217+
build/smocker-*
143218
token: ${{ secrets.GITHUB_TOKEN }}
219+
draft: ${{ steps.release_flags.outputs.draft }}
220+
prerelease: ${{ steps.release_flags.outputs.prerelease }}
221+
make_latest: ${{ steps.release_flags.outputs.make_latest }}

‎.gitignore‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,7 @@
11
.DS_Store
2-
.parcel-cache/
32
.vscode/
4-
build/
5-
coverage/
63
node_modules/
7-
sessions
8-
!tests/sessions
9-
smocker
10-
smocker.test
11-
yarn-error.log
4+
# All build, test and runtime output goes here (see Makefile / vite.config.ts / playwright.config.ts).
5+
build/
6+
# Vite builds the client straight here for embedding (release builds only, -tags embedclient).
7+
server/frontend/dist/

0 commit comments

Comments
 (0)