OAUTH-001C1J — Require exact Strava exchange client confirmation (#613) #614
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [master, main] | |
| pull_request: | |
| branches: [master, main] | |
| jobs: | |
| frontend: | |
| name: Frontend lint + build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - run: npm ci --legacy-peer-deps --ignore-scripts | |
| - name: Run non-mutating frontend lint | |
| run: node .github/scripts/check-frontend-lint.cjs | |
| - name: Verify frontend lint left the checkout unchanged | |
| run: | | |
| git diff --exit-code HEAD -- | |
| frontend_git_status="$(git status --porcelain=v1 --untracked-files=all)" | |
| test -z "$frontend_git_status" | |
| - name: Run frontend Jest tests | |
| env: | |
| CI: 'true' | |
| run: npm test -- --watchAll=false --runInBand | |
| - name: Run SPA callback safety tests | |
| run: npm run test:spa-navigation | |
| - name: Validate protected release workflow | |
| run: | | |
| ruby -e 'require "yaml"; YAML.safe_load(File.read(".github/workflows/deploy.yml"), permitted_classes: [], permitted_symbols: [], aliases: true)' | |
| ruby -e 'require "yaml"; YAML.safe_load(File.read(".github/workflows/ci.yml"), permitted_classes: [], permitted_symbols: [], aliases: true)' | |
| node --test tests/ci-workflow.test.js tests/release-workflow.test.js tests/firebase-release-verification.test.js tests/test-artifact-safety.test.js tests/root-dependency-security.test.js | |
| - name: Build | |
| env: | |
| CI: 'true' | |
| # Lint runs as its own step above; the webpack eslint pass would | |
| # otherwise fail CI=true builds on style warnings. | |
| DISABLE_ESLINT_PLUGIN: 'true' | |
| REACT_APP_RECAPTCHA_SITE_KEY: ${{ secrets.REACT_APP_RECAPTCHA_SITE_KEY }} | |
| REACT_APP_SENTRY_DSN: ${{ secrets.REACT_APP_SENTRY_DSN }} | |
| run: npm run build | |
| test-artifact-scrubber: | |
| name: Test artifact scrubber | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: '20' | |
| - name: Run emitted test artifact safety tests | |
| run: node --test tests/test-artifact-safety.test.js | |
| functions: | |
| name: Cloud Functions lint + test | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| working-directory: functions | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| cache-dependency-path: functions/package-lock.json | |
| - run: npm ci | |
| - run: npm run lint | |
| # Use test:run (plain jest) to avoid spinning up emulators in CI. | |
| # Unit tests for webhook sig verification + admin action authz mock | |
| # firebase-admin so no emulator is needed. | |
| - run: npm run test:run | |
| commerce-command-journal: | |
| name: Commerce command journal emulator | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '21' | |
| - name: Install committed root dependencies | |
| run: npm ci --legacy-peer-deps --ignore-scripts | |
| - name: Install committed Functions dependencies | |
| run: npm --prefix functions ci --ignore-scripts | |
| - name: Run commerce command journal concurrency tests | |
| env: | |
| REQUIRE_COMMERCE_COMMAND_JOURNAL_EMULATOR: '1' | |
| run: >- | |
| npx --no-install firebase emulators:exec | |
| --project demo-pay002b2-test | |
| --only firestore | |
| "npm --prefix functions run test:run -- | |
| --runInBand commerceCommandJournal.emulator.test.js" | |
| firestore-rules: | |
| name: Firestore security-rules tests | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '21' | |
| - run: npm ci --legacy-peer-deps --ignore-scripts | |
| - name: Run Firestore rules tests against the emulator | |
| run: npm run test:rules |