chore: add CI pipeline, Dependabot, and 100% coverage enforcement - #3
Merged
Conversation
Adds a composable GitHub Actions PR pipeline with three parallel jobs: - Build validation (macos-latest): bun validate-build (lint, format, typecheck, full Tauri build) - Frontend tests (ubuntu-latest): bun test:coverage (Vitest, 100% threshold) - Backend tests (macos-latest): bun test:backend (cargo test) Adds Dependabot watching npm (/), cargo (/src-tauri), and github-actions weekly. Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com>
- Add #[cfg_attr(coverage_nightly, coverage(off))] to untestable runtime functions: CGEventTap setup, AX capture, Tauri command wrappers - Add 5 new tests in commands.rs covering: invalid UTF-8 bytes in stream, mid-stream connection drop, whitespace-only lines, missing response field, and an empty-body 500 variant - Add new_activator_is_inactive test in activator.rs - Configure cargo-llvm-cov to exclude lib.rs and main.rs (Tauri runtime setup that requires a live app process) and enforce --fail-under-lines 100 - Register coverage cfgs in build.rs to suppress unexpected_cfg warnings - Update pr-backend-tests CI job to install nightly toolchain and cargo-llvm-cov via taiki-e/install-action Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com>
Security: - Remove secrets: inherit — no workflow consumes any secrets - Pin all GitHub Actions to immutable commit SHAs (checkout v4.3.1, setup-bun v2.2.0, taiki-e/install-action v2.9.4) - Make bun audit a hard failure instead of a non-blocking warning Reproducibility: - Add rust-toolchain.toml pinning nightly-2026-03-30 so the coverage toolchain is explicit and stable rather than always-latest nightly - Pin bun-version to 1.3.11 across all workflows YAGNI / cleanup: - Remove unused event_name input from all four workflow files - Remove bun pm ls (Verify dependencies) step — frozen-lockfile already guarantees consistency - Remove Setup Bun and Install dependencies steps from pr-backend-tests (cargo-llvm-cov does not require the frontend toolchain) - Change fetch-depth: 0 to fetch-depth: 1 across all reusable workflows Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add overrides.picomatch >=4.0.4 to force the patched version; tinyglobby (used by vite, vitest, typescript-eslint) was locked to the vulnerable picomatch range and bun update alone did not resolve it - brace-expansion is now resolved to 1.1.13 (minimatch@3 chain) and 5.0.5 (minimatch@10 chain) — both patched — after bun update pulled in compatible versions for each slot - Change audit step to fail on high/critical only; moderate dev-only transitive vulnerabilities that cannot be upgraded without breaking API changes (e.g. brace-expansion 1.x vs 5.x) should not permanently block CI, but high and critical always must Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…hain.toml rust-toolchain.toml at the repo root overrode ALL cargo commands project-wide, causing the build validation job to pick up nightly instead of the runner's stable Rust. Clippy is not installed for the bare nightly toolchain, so lint:backend failed. Remove rust-toolchain.toml and instead install nightly-2026-03-30 explicitly in the backend-tests workflow with the llvm-tools component. Build validation now uses the pre-installed stable toolchain as intended. Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
quiet-node
changed the title
quiet-node
added a commit
that referenced
this pull request
Apr 10, 2026
* chore: add CI pipeline and Dependabot config Adds a composable GitHub Actions PR pipeline with three parallel jobs: - Build validation (macos-latest): bun validate-build (lint, format, typecheck, full Tauri build) - Frontend tests (ubuntu-latest): bun test:coverage (Vitest, 100% threshold) - Backend tests (macos-latest): bun test:backend (cargo test) Adds Dependabot watching npm (/), cargo (/src-tauri), and github-actions weekly. Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: update bun lockfile with test dependencies Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> * test: enforce 100% Rust coverage via cargo-llvm-cov - Add #[cfg_attr(coverage_nightly, coverage(off))] to untestable runtime functions: CGEventTap setup, AX capture, Tauri command wrappers - Add 5 new tests in commands.rs covering: invalid UTF-8 bytes in stream, mid-stream connection drop, whitespace-only lines, missing response field, and an empty-body 500 variant - Add new_activator_is_inactive test in activator.rs - Configure cargo-llvm-cov to exclude lib.rs and main.rs (Tauri runtime setup that requires a live app process) and enforce --fail-under-lines 100 - Register coverage cfgs in build.rs to suppress unexpected_cfg warnings - Update pr-backend-tests CI job to install nightly toolchain and cargo-llvm-cov via taiki-e/install-action Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: formatted codebase Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> * chore: address code review findings on CI workflows Security: - Remove secrets: inherit — no workflow consumes any secrets - Pin all GitHub Actions to immutable commit SHAs (checkout v4.3.1, setup-bun v2.2.0, taiki-e/install-action v2.9.4) - Make bun audit a hard failure instead of a non-blocking warning Reproducibility: - Add rust-toolchain.toml pinning nightly-2026-03-30 so the coverage toolchain is explicit and stable rather than always-latest nightly - Pin bun-version to 1.3.11 across all workflows YAGNI / cleanup: - Remove unused event_name input from all four workflow files - Remove bun pm ls (Verify dependencies) step — frozen-lockfile already guarantees consistency - Remove Setup Bun and Install dependencies steps from pr-backend-tests (cargo-llvm-cov does not require the frontend toolchain) - Change fetch-depth: 0 to fetch-depth: 1 across all reusable workflows Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: resolve security vulnerabilities and harden audit gate - Add overrides.picomatch >=4.0.4 to force the patched version; tinyglobby (used by vite, vitest, typescript-eslint) was locked to the vulnerable picomatch range and bun update alone did not resolve it - brace-expansion is now resolved to 1.1.13 (minimatch@3 chain) and 5.0.5 (minimatch@10 chain) — both patched — after bun update pulled in compatible versions for each slot - Change audit step to fail on high/critical only; moderate dev-only transitive vulnerabilities that cannot be upgraded without breaking API changes (e.g. brace-expansion 1.x vs 5.x) should not permanently block CI, but high and critical always must Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: scope nightly Rust to backend-tests only, remove root rust-toolchain.toml rust-toolchain.toml at the repo root overrode ALL cargo commands project-wide, causing the build validation job to pick up nightly instead of the runner's stable Rust. Clippy is not installed for the bare nightly toolchain, so lint:backend failed. Remove rust-toolchain.toml and instead install nightly-2026-03-30 explicitly in the backend-tests workflow with the llvm-tools component. Build validation now uses the pre-installed stable toolchain as intended. Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com>
quiet-node
added a commit
that referenced
this pull request
Apr 10, 2026
* chore: add CI pipeline and Dependabot config Adds a composable GitHub Actions PR pipeline with three parallel jobs: - Build validation (macos-latest): bun validate-build (lint, format, typecheck, full Tauri build) - Frontend tests (ubuntu-latest): bun test:coverage (Vitest, 100% threshold) - Backend tests (macos-latest): bun test:backend (cargo test) Adds Dependabot watching npm (/), cargo (/src-tauri), and github-actions weekly. Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> * chore: update bun lockfile with test dependencies Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> * test: enforce 100% Rust coverage via cargo-llvm-cov - Add #[cfg_attr(coverage_nightly, coverage(off))] to untestable runtime functions: CGEventTap setup, AX capture, Tauri command wrappers - Add 5 new tests in commands.rs covering: invalid UTF-8 bytes in stream, mid-stream connection drop, whitespace-only lines, missing response field, and an empty-body 500 variant - Add new_activator_is_inactive test in activator.rs - Configure cargo-llvm-cov to exclude lib.rs and main.rs (Tauri runtime setup that requires a live app process) and enforce --fail-under-lines 100 - Register coverage cfgs in build.rs to suppress unexpected_cfg warnings - Update pr-backend-tests CI job to install nightly toolchain and cargo-llvm-cov via taiki-e/install-action Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> * chore: formatted codebase Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> * chore: address code review findings on CI workflows Security: - Remove secrets: inherit — no workflow consumes any secrets - Pin all GitHub Actions to immutable commit SHAs (checkout v4.3.1, setup-bun v2.2.0, taiki-e/install-action v2.9.4) - Make bun audit a hard failure instead of a non-blocking warning Reproducibility: - Add rust-toolchain.toml pinning nightly-2026-03-30 so the coverage toolchain is explicit and stable rather than always-latest nightly - Pin bun-version to 1.3.11 across all workflows YAGNI / cleanup: - Remove unused event_name input from all four workflow files - Remove bun pm ls (Verify dependencies) step — frozen-lockfile already guarantees consistency - Remove Setup Bun and Install dependencies steps from pr-backend-tests (cargo-llvm-cov does not require the frontend toolchain) - Change fetch-depth: 0 to fetch-depth: 1 across all reusable workflows Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> * fix: resolve security vulnerabilities and harden audit gate - Add overrides.picomatch >=4.0.4 to force the patched version; tinyglobby (used by vite, vitest, typescript-eslint) was locked to the vulnerable picomatch range and bun update alone did not resolve it - brace-expansion is now resolved to 1.1.13 (minimatch@3 chain) and 5.0.5 (minimatch@10 chain) — both patched — after bun update pulled in compatible versions for each slot - Change audit step to fail on high/critical only; moderate dev-only transitive vulnerabilities that cannot be upgraded without breaking API changes (e.g. brace-expansion 1.x vs 5.x) should not permanently block CI, but high and critical always must Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> * fix: scope nightly Rust to backend-tests only, remove root rust-toolchain.toml rust-toolchain.toml at the repo root overrode ALL cargo commands project-wide, causing the build validation job to pick up nightly instead of the runner's stable Rust. Clippy is not installed for the bare nightly toolchain, so lint:backend failed. Remove rust-toolchain.toml and instead install nightly-2026-03-30 explicitly in the backend-tests workflow with the llvm-tools component. Build validation now uses the pre-installed stable toolchain as intended. Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> --------- Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com>
quiet-node
added a commit
that referenced
this pull request
Apr 11, 2026
* chore: add CI pipeline and Dependabot config Adds a composable GitHub Actions PR pipeline with three parallel jobs: - Build validation (macos-latest): bun validate-build (lint, format, typecheck, full Tauri build) - Frontend tests (ubuntu-latest): bun test:coverage (Vitest, 100% threshold) - Backend tests (macos-latest): bun test:backend (cargo test) Adds Dependabot watching npm (/), cargo (/src-tauri), and github-actions weekly. Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> * chore: update bun lockfile with test dependencies Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> * test: enforce 100% Rust coverage via cargo-llvm-cov - Add #[cfg_attr(coverage_nightly, coverage(off))] to untestable runtime functions: CGEventTap setup, AX capture, Tauri command wrappers - Add 5 new tests in commands.rs covering: invalid UTF-8 bytes in stream, mid-stream connection drop, whitespace-only lines, missing response field, and an empty-body 500 variant - Add new_activator_is_inactive test in activator.rs - Configure cargo-llvm-cov to exclude lib.rs and main.rs (Tauri runtime setup that requires a live app process) and enforce --fail-under-lines 100 - Register coverage cfgs in build.rs to suppress unexpected_cfg warnings - Update pr-backend-tests CI job to install nightly toolchain and cargo-llvm-cov via taiki-e/install-action Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> * chore: formatted codebase Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> * chore: address code review findings on CI workflows Security: - Remove secrets: inherit — no workflow consumes any secrets - Pin all GitHub Actions to immutable commit SHAs (checkout v4.3.1, setup-bun v2.2.0, taiki-e/install-action v2.9.4) - Make bun audit a hard failure instead of a non-blocking warning Reproducibility: - Add rust-toolchain.toml pinning nightly-2026-03-30 so the coverage toolchain is explicit and stable rather than always-latest nightly - Pin bun-version to 1.3.11 across all workflows YAGNI / cleanup: - Remove unused event_name input from all four workflow files - Remove bun pm ls (Verify dependencies) step — frozen-lockfile already guarantees consistency - Remove Setup Bun and Install dependencies steps from pr-backend-tests (cargo-llvm-cov does not require the frontend toolchain) - Change fetch-depth: 0 to fetch-depth: 1 across all reusable workflows Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> * fix: resolve security vulnerabilities and harden audit gate - Add overrides.picomatch >=4.0.4 to force the patched version; tinyglobby (used by vite, vitest, typescript-eslint) was locked to the vulnerable picomatch range and bun update alone did not resolve it - brace-expansion is now resolved to 1.1.13 (minimatch@3 chain) and 5.0.5 (minimatch@10 chain) — both patched — after bun update pulled in compatible versions for each slot - Change audit step to fail on high/critical only; moderate dev-only transitive vulnerabilities that cannot be upgraded without breaking API changes (e.g. brace-expansion 1.x vs 5.x) should not permanently block CI, but high and critical always must Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> * fix: scope nightly Rust to backend-tests only, remove root rust-toolchain.toml rust-toolchain.toml at the repo root overrode ALL cargo commands project-wide, causing the build validation job to pick up nightly instead of the runner's stable Rust. Clippy is not installed for the bare nightly toolchain, so lint:backend failed. Remove rust-toolchain.toml and instead install nightly-2026-03-30 explicitly in the backend-tests workflow with the llvm-tools component. Build validation now uses the pre-installed stable toolchain as intended. Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com> --------- Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security
Test plan
🤖 Generated with Claude Code