Timmy
517c8dbac3
Some checks failed
Quality gates / quality (pull_request) Failing after 2m39s
Closes the PR 63 hostile-review blockers: 1. Immutable pinned Python/Pillow runtime (TIMMY_PYTHON absolute, --verify-pin), deployment/runtime re-encode smoke gate in build_release + deploy_staging. 2. Header-only width/height/total-pixel/bomb rejection before full decode; proves 6000x6000 and 12000x12000 stay resource bounded (RSS + address-space caps). 3. Fail-fast decoder concurrency ceiling; tests count actual spawned children. 4. Rate-limiter key cardinality hard-bounded under 20k+ unexpired identities, trusted-loopback-proxy identity, no spoofable forwarded headers, fixed-window boundary burst smoothed by two-window sliding count. 5. build_release explicitly syntax/gates every new JS module + Python re-encoder + production-runtime smoke; CI runs reencode-image test and the runtime pin smoke. 6. Robust polyglot contract via canonical container parsing; rejects uppercase/mixed script, appended HTML, ZIP local/EOCD and archive tails, data after canonical JPEG/PNG/WebP end; no naive compressed-byte scans (false-positive controls pass). 7. Canonical base64 data-URL grammar with byte-exact round trip; rejects missing/excess padding, whitespace/CRLF, malformed and noncanonical encodings; exact MIME policy. 8. Missing Pillow / runtime-unavailable maps to sanitized 503 + manual fallback. 9. Inbound body-read timeout and stop-on-oversize; preserves sanitized 413, base path, provider suppression, and temp cleanup; socket torn down on rejection. Audited prior partial edits: reused the sound source modules, re-wired new tests into the unit/syntax gates, fixed a non-canonical readJson that destroyed the socket before delivering 413/408, and hardened test flakiness (port reuse, EPIPE, startup races).
65 lines
1.9 KiB
YAML
65 lines
1.9 KiB
YAML
name: Quality gates
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Check out source
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
- name: Install reproducibly
|
|
run: |
|
|
npm ci
|
|
python3 -m pip install --break-system-packages -r requirements-test.txt
|
|
- name: Install browser
|
|
run: npx playwright install --with-deps chromium
|
|
- name: Unit and security tests
|
|
run: |
|
|
npm test
|
|
python3 tests/staging-deploy.test.py -v
|
|
python3 tests/reencode-image.test.py -v
|
|
- name: Mobile browser acceptance
|
|
run: |
|
|
npm start > /tmp/timmy-server.log 2>&1 &
|
|
server_pid=$!
|
|
trap 'kill "$server_pid"' EXIT
|
|
for attempt in $(seq 1 30); do
|
|
if curl --fail --silent http://127.0.0.1:4173/ > /dev/null; then
|
|
break
|
|
fi
|
|
if [ "$attempt" -eq 30 ]; then
|
|
cat /tmp/timmy-server.log
|
|
exit 1
|
|
fi
|
|
sleep 1
|
|
done
|
|
npm run test:ui
|
|
npm run test:photo
|
|
npm run test:sleek
|
|
- name: Dependency audit
|
|
run: npm audit --audit-level=high
|
|
- name: Syntax checks
|
|
run: |
|
|
npm run check:syntax
|
|
node --check tests/staging.acceptance.mjs
|
|
- name: Image runtime pin and re-encode smoke
|
|
run: python3 -c "import importlib.util,json,pathlib; s=importlib.util.spec_from_file_location('d','scripts/deploy_staging.py'); m=importlib.util.module_from_spec(s); s.loader.exec_module(m); print(json.dumps(m.verify_image_runtime(pathlib.Path('.'))))"
|
|
- name: Diff hygiene
|
|
run: npm run check:diff
|