Harden public discovery with cost-minimal revision caching #746
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Tests | |
| on: | |
| push: | |
| branches: [main, staging, production] | |
| pull_request: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| env: | |
| NODE_ENV: test | |
| CI: true | |
| PUBLIC_CONVEX_URL: https://placeholder.convex.cloud | |
| # OAuth test credentials — safe for CI | |
| OAUTH_REDIRECT_BASE_URL: http://localhost:5173 | |
| GOOGLE_CLIENT_ID: test-google-client-id | |
| GOOGLE_CLIENT_SECRET: test-google-client-secret | |
| FACEBOOK_CLIENT_ID: test-facebook-client-id | |
| FACEBOOK_CLIENT_SECRET: test-facebook-client-secret | |
| DISCORD_CLIENT_ID: test-discord-client-id | |
| DISCORD_CLIENT_SECRET: test-discord-client-secret | |
| LINKEDIN_CLIENT_ID: test-linkedin-client-id | |
| LINKEDIN_CLIENT_SECRET: test-linkedin-client-secret | |
| TWITTER_CLIENT_ID: test-twitter-client-id | |
| TWITTER_CLIENT_SECRET: test-twitter-client-secret | |
| # Shared HMAC test secrets — must be >= 32 bytes (MIN_SECRET_BYTES) or | |
| # getInternalSecret/requireInternalSecret throw and route handlers | |
| # return 500 on every test call. | |
| INTERNAL_API_SECRET: ci-test-internal-api-secret-padding-32b | |
| INTERNAL_API_SECRET_PREVIOUS: ci-test-internal-api-secret-previous-32b | |
| UNSUBSCRIBE_SECRET: ci-test-unsubscribe-secret-padding-32-bytes | |
| ADDRESS_RESOLUTION_TOKEN_SECRET: ci-test-address-resolution-token-32b-pad | |
| SESSION_CREATION_SECRET: ci-test-session-creation-secret-32b-padding | |
| BLAST_DISPATCH_SECRET: ci-test-blast-dispatch-secret-32b-padding-x | |
| BLAST_RECEIPTS_SECRET: ci-test-blast-receipts-secret-32b-padding-x | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: '.node-version' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Convex query efficiency guardrail | |
| run: npm run check:convex-queries | |
| - name: Run public-discovery focused verification | |
| run: node scripts/run-public-discovery-focused-tests.mjs | |
| - name: Run application type checks | |
| run: npm run check | |
| - name: Run Convex type checks | |
| run: npx tsc --noEmit -p convex/tsconfig.json | |
| - name: Run tests with coverage | |
| run: npm run test:coverage | |
| timeout-minutes: 10 | |
| - name: Code Coverage Summary | |
| uses: irongut/CodeCoverageSummary@v1.3.0 | |
| if: always() && hashFiles('coverage/cobertura-coverage.xml') != '' | |
| with: | |
| filename: coverage/cobertura-coverage.xml | |
| badge: true | |
| fail_below_min: false | |
| format: markdown | |
| hide_branch_rate: false | |
| hide_complexity: true | |
| indicators: true | |
| output: both | |
| thresholds: '20 40' | |
| - name: Add Coverage PR Comment | |
| uses: marocchino/sticky-pull-request-comment@v2 | |
| if: github.event_name == 'pull_request' && hashFiles('code-coverage-results.md') != '' | |
| with: | |
| recreate: true | |
| path: code-coverage-results.md | |
| - name: Build verification | |
| run: npm run build | |
| timeout-minutes: 10 |