-
Notifications
You must be signed in to change notification settings - Fork 7
Release/260325 #49
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Release/260325 #49
Changes from all commits
b850973
cdcf75f
3e1e8fc
e1293e4
90dd2da
d2867cb
ed5fba1
4778c62
825d68e
2dda3ff
da0f7de
e8e3d98
594e207
629d681
5e55027
88641f4
c1be17a
a6998de
308c3d6
59920a0
22af678
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,66 @@ | |||||||||||||||||||||||||||||
| name: CI | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| on: | |||||||||||||||||||||||||||||
| pull_request: | |||||||||||||||||||||||||||||
| branches: | |||||||||||||||||||||||||||||
| - main | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| jobs: | |||||||||||||||||||||||||||||
| test: | |||||||||||||||||||||||||||||
| runs-on: ubuntu-22.04 | |||||||||||||||||||||||||||||
| timeout-minutes: 40 | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| steps: | |||||||||||||||||||||||||||||
| - name: Checkout | |||||||||||||||||||||||||||||
| uses: actions/checkout@v4 | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - name: Setup Bun | |||||||||||||||||||||||||||||
| uses: oven-sh/setup-bun@v2 | |||||||||||||||||||||||||||||
| with: | |||||||||||||||||||||||||||||
| bun-version: latest | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - name: Cache Bun dependencies | |||||||||||||||||||||||||||||
| uses: actions/cache@v4 | |||||||||||||||||||||||||||||
| with: | |||||||||||||||||||||||||||||
| path: | | |||||||||||||||||||||||||||||
| node_modules | |||||||||||||||||||||||||||||
| ~/.bun/install/cache | |||||||||||||||||||||||||||||
| key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }} | |||||||||||||||||||||||||||||
| restore-keys: | | |||||||||||||||||||||||||||||
| ${{ runner.os }}-bun- | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - name: Install frontend dependencies | |||||||||||||||||||||||||||||
| run: bun install --frozen-lockfile | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - name: Setup Rust toolchain | |||||||||||||||||||||||||||||
| uses: dtolnay/rust-toolchain@stable | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - name: Cache Rust build artifacts | |||||||||||||||||||||||||||||
| uses: Swatinem/rust-cache@v2 | |||||||||||||||||||||||||||||
| with: | |||||||||||||||||||||||||||||
| workspaces: src-tauri -> src-tauri/target | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - name: Run unit tests | |||||||||||||||||||||||||||||
| run: bun run test:unit | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - name: Run service tests | |||||||||||||||||||||||||||||
| run: bun run test:service | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - name: Run rust unit tests | |||||||||||||||||||||||||||||
| run: bun run test:rust:unit | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - name: Run integration tests (MySQL + Postgres with testcontainers) | |||||||||||||||||||||||||||||
| run: IT_DB=all bun run test:integration | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - name: Docker diagnostics on failure | |||||||||||||||||||||||||||||
| if: failure() | |||||||||||||||||||||||||||||
| run: | | |||||||||||||||||||||||||||||
| echo "==== docker ps -a ====" | |||||||||||||||||||||||||||||
| docker ps -a || true | |||||||||||||||||||||||||||||
| echo "==== recent mysql/postgres logs ====" | |||||||||||||||||||||||||||||
| for image in mysql:8.0 postgres:16-alpine; do | |||||||||||||||||||||||||||||
| for id in $(docker ps -aq --filter "ancestor=${image}"); do | |||||||||||||||||||||||||||||
| echo "--- logs for $id (${image}) ---" | |||||||||||||||||||||||||||||
| docker logs "$id" || true | |||||||||||||||||||||||||||||
| done | |||||||||||||||||||||||||||||
| done | |||||||||||||||||||||||||||||
|
Comment on lines
+10
to
+66
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
Copilot AutofixAI 1 day ago In general, to fix this class of issue you add an explicit For this workflow, no step modifies repository contents, creates releases, comments on pull requests, or otherwise needs write access. The only privileged action is Concretely:
Suggested changeset
1
.github/workflows/ci.yml
Copilot is powered by AI and may make mistakes. Always verify output.
Refresh and try again.
|
|||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -33,3 +33,9 @@ reference | |
| # plan | ||
| .trae/documents/ | ||
| .cursor/plans/ | ||
|
|
||
| # skills | ||
| .trae/skills/* | ||
|
|
||
| # example | ||
| githubworkflowexample/* | ||
This file was deleted.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| #!/usr/bin/env bash | ||
| set -euo pipefail | ||
|
|
||
| if [[ $# -lt 1 ]]; then | ||
| echo "Usage: scripts/db-onboard.sh <db> [--skip-gate] [--skip-matrix]" | ||
| exit 1 | ||
| fi | ||
|
|
||
| db="$1" | ||
| shift || true | ||
|
|
||
| skip_gate=0 | ||
| skip_matrix=0 | ||
|
|
||
| for arg in "$@"; do | ||
| case "$arg" in | ||
| --skip-gate) | ||
| skip_gate=1 | ||
| ;; | ||
| --skip-matrix) | ||
| skip_matrix=1 | ||
| ;; | ||
| *) | ||
| echo "[error] unknown option: $arg" | ||
| echo "Usage: scripts/db-onboard.sh <db> [--skip-gate] [--skip-matrix]" | ||
| exit 1 | ||
| ;; | ||
| esac | ||
| done | ||
|
|
||
| root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" | ||
| cd "${root_dir}" | ||
|
|
||
| context_file="src-tauri/tests/common/${db}_context.rs" | ||
| integration_file="src-tauri/tests/${db}_integration.rs" | ||
| command_file="src-tauri/tests/${db}_command_integration.rs" | ||
| stateful_file="src-tauri/tests/${db}_stateful_command_integration.rs" | ||
| tracker_file="docs/zh/Development/MYSQL_TEST_COVERAGE_GAP_TRACKER.md" | ||
|
|
||
| echo "[step] scaffold check: ${db}" | ||
| missing=0 | ||
| for file in "${context_file}" "${integration_file}" "${command_file}" "${stateful_file}"; do | ||
| if [[ ! -f "${file}" ]]; then | ||
| echo "[missing] ${file}" | ||
| missing=1 | ||
| else | ||
| echo "[ok] ${file}" | ||
| fi | ||
| done | ||
|
|
||
| if [[ ${missing} -ne 0 ]]; then | ||
| echo "[error] scaffold is incomplete for '${db}'." | ||
| echo "[hint] finish scaffold first, then rerun scripts/db-onboard.sh ${db}" | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [[ ${skip_gate} -eq 0 ]]; then | ||
| echo "[step] gate syntax check" | ||
| bash -n scripts/test-integration.sh | ||
|
|
||
| echo "[step] compile smoke: ${db}_integration" | ||
| cargo test --manifest-path src-tauri/Cargo.toml --test "${db}_integration" --no-run | ||
|
|
||
| echo "[step] compile smoke: ${db}_command_integration" | ||
| cargo test --manifest-path src-tauri/Cargo.toml --test "${db}_command_integration" --no-run | ||
|
|
||
| echo "[step] compile smoke: ${db}_stateful_command_integration" | ||
| cargo test --manifest-path src-tauri/Cargo.toml --test "${db}_stateful_command_integration" --no-run | ||
|
|
||
| echo "[step] integration gate run: IT_DB=${db}" | ||
| IT_DB="${db}" bash scripts/test-integration.sh | ||
| else | ||
| echo "[skip] gate run skipped by --skip-gate" | ||
| fi | ||
|
|
||
| if [[ ${skip_matrix} -eq 0 ]]; then | ||
| echo "[step] matrix sync check" | ||
| test_count="$(rg -n "async fn test_${db}_" src-tauri/tests --glob "*.rs" || true)" | ||
| test_count="$(printf "%s\n" "${test_count}" | sed '/^$/d' | wc -l | tr -d ' ')" | ||
| echo "[info] detected test functions for ${db}: ${test_count}" | ||
| if [[ -f "${tracker_file}" ]]; then | ||
| tracker_hits="$(rg -n "test_${db}_" "${tracker_file}" || true)" | ||
| tracker_hits="$(printf "%s\n" "${tracker_hits}" | sed '/^$/d' | wc -l | tr -d ' ')" | ||
| if [[ "${tracker_hits}" -eq 0 ]]; then | ||
| echo "[warn] tracker has no '${db}' test entries yet: ${tracker_file}" | ||
| echo "[next] sync capability matrix and command coverage sections for '${db}'" | ||
| else | ||
| echo "[ok] tracker already contains ${tracker_hits} '${db}' test entries" | ||
| fi | ||
| else | ||
| echo "[warn] tracker file not found: ${tracker_file}" | ||
| fi | ||
| else | ||
| echo "[skip] matrix sync check skipped by --skip-matrix" | ||
| fi | ||
|
|
||
| echo "[done] db onboarding pipeline finished for '${db}'" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Add explicit permissions block to limit GITHUB_TOKEN scope.
The workflow does not limit the permissions of the GITHUB_TOKEN. For security best practices, add a minimal permissions block.
🔒 Proposed fix
jobs: test: runs-on: ubuntu-22.04 timeout-minutes: 40 + +permissions: + contents: readOr at the workflow level:
on: pull_request: branches: - main +permissions: + contents: read + jobs:🤖 Prompt for AI Agents