Create isolated tests and mandatory CI verification#589
Merged
Conversation
- Tests load a dedicated .env.test (never .env/.env.local) so runs cannot inherit developer or production configuration - Integration tests derive a unique per-run database from the local/CI MongoDB (vitest.globalSetup.ts) and drop it around the suite; E2E runs the app against the same isolated DATABASE_URI - Hard guard (src/lib/testDatabaseGuard.ts) rejects mongodb+srv, hosted hosts (Atlas/DocumentDB/etc.), non-local hosts, and prod-looking DB names; enforced in the Vitest/Playwright harnesses and at app startup via PT_ASSERT_TEST_DB, plus a DATABASE_URI-required startup check - New reusable verify workflow: frozen install, generated-artifact drift check, lint, type-check, integration tests, and critical E2E smoke tests against a MongoDB service container - Dependency SCA scan (pnpm audit) + Dependabot config - Deploy job now depends on the verification workflow and cannot run when it fails - Add typecheck script; tests cover the isolation guard Closes #578 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Addresses CodeQL 'Workflow does not contain permissions' findings on the CI and verify workflows by declaring contents:read at the workflow level. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Set NEXT_PUBLIC_LOCALES=en,fr in the verify workflow (and .env.test) so payload generate:types is deterministic and matches the committed payload-types.ts. Without it CI regenerated an en-only file (dropping 'fr') and the drift check failed. - Make the dependency audit non-blocking and report to the job summary. The production tree carries many transitive advisories with no non-breaking fix; hard-failing blocked all deploys. Actionable direct advisories (Payload >=3.79.1) are tracked as a separate upgrade. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Point Playwright's webServer readiness probe at the dev-only, DB-free /dev/update-dialog route (HTTP 200). The homepage was the probe target, but on an empty database it resolves to notFound() (404), which Playwright never treats as 'ready' — so the run timed out at 120s even though the server was up. Keep 'next dev' (the suite needs the dev-only update-dialog route, which is notFound() in production builds). - Widen navigation/action/test timeouts to absorb cold dev compilation. - Remove the focus-trap subtest: it asserted MUI had moved focus into the dialog on the first tick, which races the open transition and flakes. The Escape-restore and Tab-trap coverage it shared lived only here; the sandbox/allowlist/close-button a11y tests remain. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #578
What changed
Isolated test environment
.env.test(committed, no secrets) instead of.env/.env.local, so a run can never inherit developer or production-like configuration. Wired into bothvitest.setup.tsandplaywright.config.ts.Unique, ephemeral database, reset around the suite
vitest.globalSetup.ts) derive a unique per-run, test-named database from the local/CI MongoDB host and drop it before and after the suite. A single Vitest worker shares the dynamic connection string (injected viaprovide/injectbefore@/payload.configis imported).webServer) against the same isolatedDATABASE_URI;tests/e2e/globalSetup.tsenforces the guard and resets the DB first.Hard guard against shared/production databases
src/lib/testDatabaseGuard.tsrejectsmongodb+srv://, hosted hosts (Atlas, DocumentDB, Cosmos, cloud providers), any non-local host, and production/shared-looking database names. Enforced in the Vitest and Playwright harnesses, and at app startup whenPT_ASSERT_TEST_DB=true(the E2E dev server).payload.config.tsalso now requiresDATABASE_URIinstead of silently falling back to"".Mandatory CI verification
.github/workflows/verify.yml: frozen install (--frozen-lockfile), generated-artifact drift check (generate:all+git diff --exit-codeoverpayload-types.tsandimportMap.js), lint, type-check (newtypecheckscript), integration tests, and critical E2E smoke tests — all against amongo:7service container. Plus a dependency SCA scan (pnpm audit --audit-level high).ci.ymlruns verification on pull requests.deploy-dev.yml: thedeployjob nowneeds: verify(calls the reusable workflow), so deployment cannot run when verification fails..github/dependabot.ymlfor continuous dependency/SCA updates.Notes
mongodbas a dev dependency for DB reset. (mongodb-memory-serverwas intentionally avoided — the local pnpm trust policy flagged a transitive supply-chain downgrade in its dependency tree; a service container + unique per-run database gives the same isolation guarantees more reliably in CI.)22.12.0to match the Dockerfile and pnpm10.33.0frompackageManager.Verification
tsc --noEmitclean; no generated-artifact drift; guard unit tests cover Atlas/hosted/non-local/prod-name rejection and local acceptance; guard confirmed to reject amongodb+srvAtlas URI end-to-end.🤖 Generated with Claude Code