timmy
bc64055196
Quality gates / quality (pull_request) Canceled after 0s
Brings #82 up to today's `main` (1bbcc10) and resolves the two conflicts as ordered
unions: `package.json` `test`/`check:syntax` and the release builder's syntax allow-list
and evidence keys. Both sides only appended, so nothing was dropped.
Verifying the merge against main's RC attack suite (#40) found two real defects, each
fixed test-first:
- An oversized body destroyed the socket mid-upload, so the caller saw `fetch failed`
instead of the 413 it had already earned, and `security_attack_suite.mjs` could not
complete at all. New test in `tests/analyze-ingress.acceptance.test.js` failed with
`fetch failed` before the fix; `src/http-body.js` now keeps draining without buffering
and refuses on `end`, so the ceiling still holds and the refusal is readable.
- #16's per-caller budget turned the suite's own load phase into 8/8 429s, which would
have published refusals as analysis latency. The load phase now runs against a second
permissive target and the suite refuses to publish a load figure if any sample was
refused. `buildReport` also publishes `evidenceVerified`, so the verdict is
re-derivable from the report — asserted by #40's acceptance test, which only trips once
the verdict is GO.
Evidence on the merged tree: `npm test` 277/277, `test:security-attack` 8/8, the RC attack
suite returns VERDICT: GO with both P0 ingress cases passing (main is BLOCKED on exactly
those two), 14 browser acceptance suites green, and the release demo records end to end
(8:13, 97 captions) including the on-camera refusal scene.
78 lines
2.2 KiB
YAML
78 lines
2.2 KiB
YAML
name: Quality gates
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Check out source
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
- name: Install reproducibly
|
|
run: |
|
|
npm ci
|
|
python3 -m pip install --break-system-packages -r requirements-test.txt
|
|
- name: Install browser
|
|
run: npx playwright install --with-deps chromium
|
|
- name: Unit and security tests
|
|
run: |
|
|
npm test
|
|
npm run test:security-attack
|
|
python3 tests/staging-deploy.test.py -v
|
|
python3 tests/corpus-manifest.test.py -v
|
|
python3 tests/corpus-review.test.py -v
|
|
python3 tests/dataset-card.test.py -v
|
|
python3 tests/calibration-harness.test.py -v
|
|
- name: Mobile browser acceptance
|
|
run: |
|
|
npm start > /tmp/timmy-server.log 2>&1 &
|
|
server_pid=$!
|
|
trap 'kill "$server_pid"' EXIT
|
|
for attempt in $(seq 1 30); do
|
|
if curl --fail --silent http://127.0.0.1:4173/ > /dev/null; then
|
|
break
|
|
fi
|
|
if [ "$attempt" -eq 30 ]; then
|
|
cat /tmp/timmy-server.log
|
|
exit 1
|
|
fi
|
|
sleep 1
|
|
done
|
|
npm run test:ui
|
|
npm run test:photo
|
|
npm run test:mobile-capture
|
|
npm run test:ingress-capture
|
|
npm run test:sleek
|
|
npm run test:manual-fallback
|
|
npm run test:provisional
|
|
npm run test:followup
|
|
npm run test:vision-refusal
|
|
npm run test:worker-readiness
|
|
npm run test:pattern-summary
|
|
npm run test:photo-lifecycle
|
|
npm run test:training-contribution
|
|
npm run test:portability
|
|
- name: Dependency audit
|
|
run: npm audit --audit-level=high
|
|
- name: Syntax checks
|
|
run: |
|
|
npm run check:syntax
|
|
node --check tests/staging.acceptance.mjs
|
|
- name: Diff hygiene
|
|
run: npm run check:diff
|