Timmy
b8532f587d
All checks were successful
Quality gates / quality (pull_request) Successful in 1m42s
Implements #35. - importLedger migrates prior schema versions (v0 bare-array legacy exports and the v1 envelope) and fails safely on future versions, malformed JSON, wrong-product envelopes, and oversized files with a new 2 MiB MAX_IMPORT_BYTES guard applied before parsing. - exportLedger normalizes entries through sanitizeEntry so confirmed values and bounded provenance round-trip while smuggled secrets and unknown fields never enter the portable file. - Entries may carry a whitelisted provenance origin ('user' or 'ai-suggestion'); mergeVisualSuggestion records 'ai-suggestion' only when a suggestion is actually applied, keeping nonvisual fields user-owned. - App import now merges into the existing ledger instead of replacing it, so a failed or partial import can never silently drop user-owned records. - Service-worker shell cache bumped to v6 (per base-path namespace) so installed PWAs receive the migration code; old v5 caches are purged on activation. - New tests/ledger-portability.acceptance.mjs browser gate covers export round trip, merge import, safe-failure surfacing, root vs /timmy-staging storage isolation, and Delete Everything for both namespaces; wired into package.json test:portability and CI quality.yml. Deterministic medical safety unchanged: urgent-flag detection, red-flag copy, and chat escalation paths are untouched; all fixtures synthetic.
63 lines
1.6 KiB
YAML
63 lines
1.6 KiB
YAML
name: Quality gates
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Check out source
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
- name: Install reproducibly
|
|
run: |
|
|
npm ci
|
|
python3 -m pip install --break-system-packages -r requirements-test.txt
|
|
- name: Install browser
|
|
run: npx playwright install --with-deps chromium
|
|
- name: Unit and security tests
|
|
run: |
|
|
npm test
|
|
python3 tests/staging-deploy.test.py -v
|
|
- name: Mobile browser acceptance
|
|
run: |
|
|
npm start > /tmp/timmy-server.log 2>&1 &
|
|
server_pid=$!
|
|
trap 'kill "$server_pid"' EXIT
|
|
for attempt in $(seq 1 30); do
|
|
if curl --fail --silent http://127.0.0.1:4173/ > /dev/null; then
|
|
break
|
|
fi
|
|
if [ "$attempt" -eq 30 ]; then
|
|
cat /tmp/timmy-server.log
|
|
exit 1
|
|
fi
|
|
sleep 1
|
|
done
|
|
npm run test:ui
|
|
npm run test:photo
|
|
npm run test:sleek
|
|
npm run test:portability
|
|
- name: Dependency audit
|
|
run: npm audit --audit-level=high
|
|
- name: Syntax checks
|
|
run: |
|
|
npm run check:syntax
|
|
node --check tests/staging.acceptance.mjs
|
|
- name: Diff hygiene
|
|
run: npm run check:diff
|