Leon SerfatyandClaude Opus 5
eb36b81dc9
- Add superadmin impersonation: sessions.impersonated_by (migration 0003) is stamped onto audit rows so impersonated actions are attributable, with a persistent ImpersonationBanner in the app shell. - Harden auth and upload handling across routes (safe redirect targets, filename sanitization, checkout grant handling). - Update dependencies: Sentry 8 -> 10, @fastify/static 8 -> 10, react-router-dom 6.30.6; add find-my-way / fast-uri overrides. - Add tests for safe-next, checkout-grant, and upload-filename. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
45 lines
1.2 KiB
YAML
45 lines
1.2 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: ['**']
|
|
pull_request:
|
|
|
|
jobs:
|
|
build-and-test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Typecheck (all workspaces)
|
|
run: npm run typecheck
|
|
|
|
- name: Test (all workspaces)
|
|
run: npm test
|
|
|
|
- name: Build web
|
|
run: npm run build
|
|
|
|
# Gate: any HIGH/CRITICAL advisory in a dependency that actually ships to production fails
|
|
# the build. Scoped with --omit=dev on purpose — the dev-only toolchain (vite, esbuild,
|
|
# drizzle-kit) carries advisories that only affect a developer's local dev server, and
|
|
# blocking every PR on those trains people to ignore the gate.
|
|
- name: Audit production dependencies
|
|
run: npm audit --omit=dev --audit-level=high
|
|
|
|
# Full picture, including dev tooling. Never blocks — it's here so regressions are visible
|
|
# in the log and someone can act on them deliberately.
|
|
- name: Audit report (informational, includes dev)
|
|
if: always()
|
|
run: npm audit || true
|