Repository navigation
Implementing unit test and input validation for API along with structured error handling - #258
Conversation
|
Still working to get the backend and frontend linked together, so I can start writing some tests for the backend. |
Hbarsanti
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| frontend-test: | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Cache Node.js modules | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: ~/.npm | ||
| key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-npm- | ||
|
|
||
| - name: Set up Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "16" | ||
|
|
||
| - name: Install dependencies | ||
| run: | | ||
| cd frontend | ||
| npm install | ||
|
|
||
| - name: Run frontend tests | ||
| run: | | ||
| cd frontend | ||
| npm run test:ci | ||
|
|
||
| - name: Upload coverage report as artifact | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: coverage-report |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
To address the problem, a permissions block should be added explicitly to the workflow file to restrict the access of the GITHUB_TOKEN used by the jobs. The recommended least privilege baseline is contents: read, which covers basic operations like code checkout and reading artifacts, and is sufficient for almost all build/test/upload workflows. This block can be added at the root of the workflow file (just below the name: and before on:) to apply to all jobs, or per-job if finer granularity is needed. For this case, adding a root-level permissions: block with contents: read is the best and simplest solution. Edit the file .github/workflows/frontend-ci.yml by inserting the following:
permissions:
contents: readdirectly after the name: line, at line 2.
| @@ -1,4 +1,6 @@ | ||
| name: Frontend CI | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| push: |
There was a problem hiding this comment.
this seems like a valuable and quick win for security.
| - name: Set up Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "16" |
There was a problem hiding this comment.
hopefully trivial updates like this will go away with the work @ahmedbektic is doing.
Hbarsanti
changed the title
CharlieWells13
left a comment
CharlieWells13
left a comment
There was a problem hiding this comment.
Looks good, this should develop into something really useful over time. It would be nice if there was a file somewhere detailing every test and what is does in detail.
4 participants
Issue link: #261 , #268
Started looking deeper into implementing unit tests, specifically with React Testing Framework.
Updated the Env Configuration so the wind velocity input has a stable data-testid, and added a Jest/RTL suite (EnvironmentConfiguration.test.jsx) that mocks Google Maps to exercise the map-click origin update and the wind-force clamping logic.
To run the tests:
npm test