mirror of
https://github.com/vee1e/krply.git
synced 2026-09-01 09:49:51 +00:00
lakshit verma
9f4b6c2c5a
Audit: correlation event_ids include stage and response code so the multi-stage lines of one request no longer collapse under dedup; match scans are bounded to a time window and a page instead of the object's full history. Web: dry-run results are read from dry_run_result (nested) so the verdict is rendered correctly and conflicts/errors/skipped are shown; the plans view no longer POSTs an unsolicited plan on page load; coverage and streams surface API errors instead of showing a misleading empty state and follow cursor pagination so they are not stuck on the oldest page; the diff path tokenizer handles backslash-escaped dotted keys. Deploy/CI: the chart no longer grants the query server a cluster-wide read ClusterRole, runs as non-root with a read-only root filesystem, adds liveness/readiness probes, wires the ConfigMap as env (STORE_PATH, LISTEN_ADDR), defaults the journal to a PVC instead of an ephemeral emptyDir, and adds imagePullSecrets; the replay ClusterRole drops the unused update verb; a Dockerfile builds a static distroless image; GitHub actions are pinned by commit SHA, jobs set least-privilege permissions, the Vercel deploy skips fork PRs, CI passes the Makefile test timeouts, and make lint runs a real web syntax check. Docs: event-schema/consistency no longer describe an ingest_sequence field, an observed-time-based event_id, or restart-from-checkpoint; the threat model documents the unauthenticated HTTP API surface and the chart's RBAC change; replay-safety matches the enforced dry-run gate.
87 lines
1.9 KiB
YAML
87 lines
1.9 KiB
YAML
name: ci
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
concurrency:
|
|
group: ci-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
go:
|
|
name: build and test
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
|
|
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
|
|
with:
|
|
go-version: "1.26.x"
|
|
cache: true
|
|
|
|
- name: Build
|
|
run: go build ./...
|
|
|
|
- name: Vet
|
|
run: go vet ./...
|
|
|
|
- name: Unit tests
|
|
run: go test ./...
|
|
|
|
- name: Integration tests (fake apiserver)
|
|
run: go test -tags integration ./test/integration/... -timeout 20m
|
|
|
|
- name: End-to-end tests
|
|
run: go test -tags e2e ./test/e2e/... -timeout 30m
|
|
|
|
web:
|
|
name: build web ui
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
|
with:
|
|
node-version: "22"
|
|
|
|
- name: Install
|
|
working-directory: web
|
|
run: npm ci
|
|
|
|
- name: Lint
|
|
working-directory: web
|
|
run: npm run lint
|
|
|
|
- name: Build
|
|
working-directory: web
|
|
run: npm run build
|
|
|
|
- name: Verify dist
|
|
run: test -d web/dist && test -f web/dist/index.html
|
|
|
|
web:
|
|
name: build web ui
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
|
|
- name: Install
|
|
working-directory: web
|
|
run: npm ci
|
|
|
|
- name: Build
|
|
working-directory: web
|
|
run: npm run build
|
|
|
|
- name: Verify dist
|
|
run: test -d web/dist && test -f web/dist/index.html
|