Skip to content
CI

Merge #11: hash refresh tokens at rest with HMAC-SHA256 #55

Sign in to view logs

Merge #11: hash refresh tokens at rest with HMAC-SHA256

Merge #11: hash refresh tokens at rest with HMAC-SHA256 #55

Workflow file for this run

.github/workflows/ci.yml at cb37473
# CI: install, lint, format check, build, unit tests, e2e (Playwright)
# Uses latest action versions; Node 24 + pnpm 10 per package.json engines.
name: CI
on:
push:
branches: [main, master]
pull_request:
branches: [main, master]
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
lint-and-build:
name: Lint & Build
runs-on: ubuntu-latest
# Dummy URL only for prisma generate during install; no DB needed for lint/build.
env:
DATABASE_URL: postgresql://localhost:5432/ci?schema=public
steps:
- name: Checkout
uses: actions/checkout@v6
- name: Install pnpm
uses: pnpm/action-setup@v4
with:
run_install: false
- name: Set up Node.js
uses: actions/setup-node@v6
with:
node-version: "24"
cache: "pnpm"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Lint
run: pnpm run lint
- name: Lint (security)
run: pnpm run lint:security
- name: Format check
run: |
pnpm run format
if ! git diff --exit-code; then
echo "::error::Some files are not formatted. Run 'pnpm run format' and commit the changes."
git diff --name-only
exit 1
fi
- name: Build
run: pnpm run build
test:
name: Unit tests
runs-on: ubuntu-latest
# Dummy URL only for prisma generate during install; unit tests mock Prisma.
env:
DATABASE_URL: postgresql://localhost:5432/ci?schema=public
steps:
- name: Checkout
uses: actions/checkout@v6
- name: Install pnpm
uses: pnpm/action-setup@v4
with:
run_install: false
- name: Set up Node.js
uses: actions/setup-node@v6
with:
node-version: "24"
cache: "pnpm"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Build workspace packages
run: pnpm --filter @bunker46/shared-types --filter @bunker46/config run build
- name: Run unit tests
run: pnpm run test
e2e:
name: E2E (Playwright)
runs-on: ubuntu-latest
services:
postgres:
image: postgres:16
env:
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
POSTGRES_DB: bunker46
options: >-
--health-cmd "pg_isready -U postgres"
--health-interval 10s
--health-timeout 5s
--health-retries 5
ports:
- 5432:5432
env:
DATABASE_URL: postgresql://postgres:postgres@localhost:5432/bunker46
JWT_SECRET: ci-jwt-secret-min-32-chars-long-for-e2e
ENCRYPTION_KEY: ci-encryption-key-min-32-chars-for-e2e
steps:
- name: Checkout
uses: actions/checkout@v6
- name: Install pnpm
uses: pnpm/action-setup@v4
with:
run_install: false
- name: Set up Node.js
uses: actions/setup-node@v6
with:
node-version: "24"
cache: "pnpm"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Push database schema
run: pnpm --filter @bunker46/server run db:push
- name: Cache Playwright browsers
uses: actions/cache@v4
id: playwright-cache
with:
path: ~/.cache/ms-playwright
key: ${{ runner.os }}-playwright-1.58.2
- name: Install Playwright browsers (Chromium)
if: steps.playwright-cache.outputs.cache-hit != 'true'
run: pnpm exec playwright install chromium --with-deps
- name: Install Playwright system deps (cache hit)
if: steps.playwright-cache.outputs.cache-hit == 'true'
run: pnpm exec playwright install-deps chromium
- name: Build for E2E
run: pnpm run build
- name: Run E2E tests
run: |
pnpm --filter @bunker46/server run start &
echo "Waiting for API on port 3000..."
for i in $(seq 1 60); do
curl -s -o /dev/null http://127.0.0.1:3000 && break
sleep 1
done
pnpm run e2e
env:
CI: true
E2E_USE_PREVIEW: "1"