nostrkey.browser.plugin.src/.github/workflows/ci.yml at main · HumanjavaEnterprises/nostrkey.browser.plugin.src · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
name: CI
on:
  push: {}                 # every push, any branch
  pull_request:
    branches: [main]
  workflow_dispatch: {}    # manual runs

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version-file: '.nvmrc'   # single source of truth (Node 24)
          cache: 'npm'
      - run: npm ci
      - run: npm run build:all:prod
      - run: npm test
      # Production-affecting CVEs only — dev-tooling advisories must not red the build.
      - run: npm audit --omit=dev --audit-level=high

  # Ring-2 consent-surface e2e — GATES the build. Loads the real extension in
  # Chromium; the redress + sheet-lifecycle specs are hermetic (routed fixture,
  # service-worker-seeded demo profile — no network). Chromium extensions require
  # a headed browser, so CI runs it under an xvfb virtual display.
  e2e-consent:
    name: e2e — consent surface (Ring-2)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'
      - run: npm ci
      - run: npx playwright install --with-deps chromium
      - run: sudo apt-get update && sudo apt-get install -y xvfb
      - run: npm run build:chrome
      - name: consent e2e (redress + sheet lifecycle)
        run: xvfb-run -a npm run test:e2e:consent
      - uses: actions/upload-artifact@v7
        if: failure()
        with:
          name: playwright-report-consent
          path: |
            playwright-report/
            test-results/
          retention-days: 7

  # Settings + extension e2e — best-effort (hits a live URL / display quirks), so
  # it stays non-gating; failures don't red the build.
  e2e-legacy:
    name: e2e — settings + extension (non-gating)
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'
      - run: npm ci
      - run: npx playwright install --with-deps chromium
      - run: sudo apt-get update && sudo apt-get install -y xvfb
      - run: npm run build:chrome
      - run: xvfb-run -a npx playwright test test/e2e/extension.spec.js test/e2e/settings-persistence.spec.js