fix(web): proxy /query in the Vite dev server #692

Workflow file for this run

	name: CI/CD Pipeline

	on:
	push:
	branches: [ main ]
	tags: [ 'v*' ]
	paths-ignore:
	- '.github/CODEOWNERS'
	- '.github/SECURITY.md'
	- '.slsa-goreleaser/**'
	- '.gitignore'
	- 'docs/**'
	- '**.md'
	pull_request:
	branches: [ main ]
	paths-ignore:
	- '.github/CODEOWNERS'
	- '.github/SECURITY.md'
	- '.slsa-goreleaser/**'
	- '.gitignore'
	- 'docs/**'
	- '**.md'

	# NOTE: If your enterprise restricts GITHUB_TOKEN permissions,
	# create a Personal Access Token (PAT) with 'repo' and 'write:packages' scopes
	# and add it as a secret named 'GH_PAT'

	env:
	GO_VERSION: '1.26'
	DAGGER_VERSION: '0.18.14'
	REGISTRY: ghcr.io
	IMAGE_NAME: ${{ github.repository }}

	jobs:
	lint:
	name: Lint Code
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v5

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version: ${{ env.GO_VERSION }}

	- name: Download dependencies
	run: go mod download

	- name: Install mockgen
	run: go install github.com/golang/mock/mockgen@v1.6.0

	- name: Generate mocks
	run: go generate ./...

	- uses: dagger/dagger-for-github@8.0.0
	with:
	version: ${{ env.DAGGER_VERSION }}
	verb: call
	module: ./ci
	args: lint --source .

	test:
	name: Run Tests
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v5

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version: ${{ env.GO_VERSION }}

	- name: Install mockgen
	run: go install github.com/golang/mock/mockgen@v1.6.0

	- name: Add Go bin to PATH
	run: echo "$(go env GOPATH)/bin" >> $GITHUB_PATH

	- name: Download dependencies
	run: go mod download

	- uses: dagger/dagger-for-github@8.0.0
	with:
	version: ${{ env.DAGGER_VERSION }}
	verb: call
	module: ./ci
	args: test --source .

	- name: Run JS client tests
	run: node web/js/graphql-client-test.js

	- name: Run tests with coverage
	run: \|
	go test -race -coverprofile=coverage.txt -covermode=atomic ./...

	- name: Upload coverage to Codecov
	uses: codecov/codecov-action@v5
	with:
	token: ${{ secrets.CODECOV_TOKEN }}
	files: ./coverage.txt
	flags: unittests
	name: codecov-umbrella
	fail_ci_if_error: false

	web-v2:
	# v2 SPA (Vite + React + TypeScript) lives at web-v2/. Its built
	# output is embedded into the Go binary via //go:embed all:dist,
	# so the Go test/build jobs above don't catch a broken TypeScript
	# source — the pre-checked-in dist/ keeps embedding cleanly. This
	# job is the source-side safety net: typecheck, lint, unit tests,
	# production build, and a schema-drift check between the GraphQL
	# SDL the Go backend exposes and the copy web-v2 codegen consumes.
	#
	# No untrusted user input flows into run: blocks. The only ${{ }}
	# expression is github.workspace, which is GitHub-controlled.
	name: Web v2 (typecheck · lint · test · build · schema check)
	runs-on: ubuntu-latest
	timeout-minutes: 15
	# Read-only token: this job only checks out and builds. Keeps the
	# blast radius minimal if a dependency in the build is compromised.
	permissions:
	contents: read
	steps:
	# Actions pinned to full commit SHAs (not moving tags) so an action
	# owner cannot silently repoint a tag at malicious code in our runner.
	- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
	with:
	persist-credentials: false

	- name: GraphQL schema drift check
	# Backend SDL is the source of truth; web-v2 keeps a synced
	# copy so its codegen produces typed clients. Fail loudly if
	# they ever diverge.
	run: \|
	diff -q internal/reporter/graphql/schema.graphql \
	web-v2/src/gql/schema.graphql \
	\|\| { echo "::error::GraphQL schema drift between backend and web-v2 copy. Sync the two files."; exit 1; }

	- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
	with:
	version: 9

	- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
	with:
	node-version: '20'
	cache: 'pnpm'
	cache-dependency-path: web-v2/pnpm-lock.yaml

	- name: Install dependencies
	working-directory: web-v2
	run: pnpm install --frozen-lockfile

	- name: Typecheck
	working-directory: web-v2
	run: pnpm typecheck

	- name: Lint
	working-directory: web-v2
	run: pnpm lint

	- name: Unit tests
	working-directory: web-v2
	run: pnpm test:run

	- name: Build production bundle
	working-directory: web-v2
	run: pnpm build

	security-scan:
	name: Security Scan (Trivy)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v5

	- uses: dagger/dagger-for-github@8.0.0
	with:
	version: ${{ env.DAGGER_VERSION }}
	verb: call
	module: ./ci
	args: security-scan --source .

	vulnerability-check:
	name: Go Vulnerability Check
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v5

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version: ${{ env.GO_VERSION }}

	- name: Install govulncheck
	run: go install golang.org/x/vuln/cmd/govulncheck@v1.3.0

	- name: Run govulncheck
	run: \|
	# Advisory-only: \|\| true prevents blocking merges on vulnerabilities in indirect
	# dependencies that have no available fix. Remove once all transitive CVEs are cleared.
	govulncheck ./cmd/... ./internal/... ./pkg/... \|\| true

	dependency-review:
	name: Dependency Review
	runs-on: ubuntu-latest
	if: github.event_name == 'pull_request'
	steps:
	- uses: actions/checkout@v5
	- uses: actions/dependency-review-action@v4.7.1
	with:
	fail-on-severity: moderate
	# Allow-list of advisories confined to the web-v2 dev/build/test
	# toolchain (babel, esbuild, vite, ws, lodash, form-data, immutable,
	# js-yaml — pulled via graphql-codegen / jsdom / vite). None reach the
	# shipped production bundle (verified: no runtime dependency path), and
	# several have no in-place patch on the pinned major (e.g. vite's
	# server.fs.deny fix lands only in 6.x). fail-on-scopes can't filter
	# these because GitHub's dependency graph carries no dev/runtime scope
	# for the pnpm lockfile. Runtime deps stay fully enforced at moderate+.
	# Revisit when the web-v2 toolchain is upgraded.
	allow-ghsas: GHSA-4x5r-pxfx-6jf8,GHSA-67mh-4wv8-2f99,GHSA-hmw2-7cc7-3qxx,GHSA-wf6x-7x77-mvgw,GHSA-h67p-54hq-rp68,GHSA-r5fr-rjxr-66jc,GHSA-f23m-r3pf-42rh,GHSA-4w7w-66w2-5vf9,GHSA-v6wh-96g9-6wx3,GHSA-fx2h-pf6j-xcff,GHSA-96hv-2xvq-fx4p,GHSA-v56q-mh7h-f735,GHSA-xvcm-6775-5m9r

	build:
	name: Build Images
	runs-on: ubuntu-latest
	# For PRs, only run a single build test. For main/tags, build all platforms
	strategy:
	matrix:
	platform: ${{ github.event_name == 'pull_request' && fromJson('["linux/amd64"]') \|\| fromJson('["linux/amd64", "linux/arm64"]') }}
	steps:
	- uses: actions/checkout@v5

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3

	- name: Cache Docker layers
	uses: actions/cache@v4
	with:
	path: /tmp/.buildx-cache
	key: ${{ runner.os }}-buildx-${{ github.sha }}
	restore-keys: \|
	${{ runner.os }}-buildx-

	- uses: dagger/dagger-for-github@8.0.0
	with:
	version: ${{ env.DAGGER_VERSION }}
	verb: call
	module: ./ci
	args: build --source . --platforms ${{ matrix.platform }}


	all-checks:
	name: All Checks (Main Branch)
	runs-on: ubuntu-latest
	if: github.event_name == 'push' && github.ref == 'refs/heads/main'
	steps:
	- uses: actions/checkout@v5

	- uses: dagger/dagger-for-github@8.0.0
	with:
	version: ${{ env.DAGGER_VERSION }}
	verb: call
	module: ./ci
	args: all --source .

	upload-main-coverage:
	name: Upload Coverage (main)
	runs-on: ubuntu-latest
	permissions:
	contents: read
	if: github.event.repository.fork == false && github.ref == 'refs/heads/main'
	steps:
	- uses: actions/checkout@v4
	with:
	persist-credentials: false
	- uses: actions/setup-go@v5
	with:
	go-version: ${{ env.GO_VERSION }}
	- run: go test -race -coverprofile=coverage.txt -covermode=atomic ./...
	# codecov/codecov-action v5.1.2 (pinned for security)
	- uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7
	with:
	token: ${{ secrets.CODECOV_TOKEN }}
	files: ./coverage.txt
	flags: unittests
	name: main-coverage
	fail_ci_if_error: false

Navigation Menu

Uh oh!

fix(web): proxy /query in the Vite dev server #692

Workflow file

fix(web): proxy /query in the Vite dev server #692

Uh oh!

Workflow file for this run