chore(deps): bump nanoid from 3.3.11 to 3.3.18 in /dashboard #1184
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| jobs: | |
| backend: | |
| name: Backend Tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: server | |
| services: | |
| postgres: | |
| image: postgres:16 | |
| env: | |
| POSTGRES_USER: wrzdj | |
| POSTGRES_PASSWORD: wrzdj | |
| POSTGRES_DB: wrzdj_test | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up Python | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.11" | |
| cache: "pip" | |
| cache-dependency-path: server/pyproject.toml | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" | |
| - name: Lint with ruff | |
| run: ruff check . | |
| - name: Format check with ruff | |
| run: ruff format --check . | |
| - name: Security scan with bandit | |
| run: bandit -r app -c pyproject.toml | |
| - name: Dependency audit with pip-audit | |
| # Ignored CVEs (each requires explicit justification + revisit cadence): | |
| # CVE-2024-23342 (ecdsa timing attack) - transitive from python-jose, no fix released yet | |
| # CVE-2026-3219 (pip 26.x: concatenated tar/ZIP handling, CVSS 4.6 MEDIUM) - | |
| # affects pip the build tool, not runtime deps. Our CI installs from | |
| # pinned requirements only; no untrusted-source install path. Fix is | |
| # in pip PR #13870; revisit when GitHub Actions ships a patched pip. | |
| # CVE-2026-6357 (pip 26.x: PATH handling) - same class as above; affects pip the | |
| # build tool only, not runtime deps. Revisit when GHA upgrades pip. | |
| # PYSEC-2025-183 (pyjwt 2.10.1+ weak encryption, DISPUTED) - no fix released, the | |
| # pyjwt maintainers contest the advisory. We already pin pyjwt to the | |
| # latest available (2.12.1). Revisit when an upstream fix lands. | |
| # MAL-2026-4750 (fastapi 0.136.3 "malicious code", WITHDRAWN by OSV 2026-05-26) - | |
| # False positive. 0.136.3 is an official tiangolo release; the flagged | |
| # dependency 'fastar' is a legitimate Rust-tar-bindings package | |
| # (published Oct 2025, predates the release) and is pulled ONLY via | |
| # fastapi's [standard] extra, which we do NOT install (we use plain | |
| # fastapi + uvicorn[standard]) - so it never enters our dependency tree. | |
| # We deliberately stay on 0.136.3 for its underscore-header rejection | |
| # (PR #15589) and SSE field validation (PR #15588). OSV withdrew the | |
| # advisory; pip-audit's feed still serves it. REMOVE this ignore once | |
| # the withdrawn entry is purged from the feed. | |
| run: pip-audit --ignore-vuln CVE-2024-23342 --ignore-vuln CVE-2026-3219 --ignore-vuln CVE-2026-6357 --ignore-vuln PYSEC-2025-183 --ignore-vuln MAL-2026-4750 | |
| - name: Run tests with coverage | |
| env: | |
| DATABASE_URL: postgresql+psycopg://wrzdj:wrzdj@localhost:5432/wrzdj_test | |
| JWT_SECRET: test-secret-key | |
| ENV: development | |
| run: pytest -n 4 --dist=loadfile --cov=app --cov-report=xml --cov-report=term-missing --durations=25 --durations-min=1.0 | |
| - name: Check Alembic migrations are up to date | |
| env: | |
| DATABASE_URL: postgresql+psycopg://wrzdj:wrzdj@localhost:5432/wrzdj_test | |
| JWT_SECRET: test-secret-key | |
| ENV: development | |
| run: alembic upgrade head && alembic check | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0 | |
| with: | |
| files: server/coverage.xml | |
| flags: backend | |
| fail_ci_if_error: false | |
| frontend: | |
| name: Frontend Tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: dashboard | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: "22" | |
| cache: "npm" | |
| cache-dependency-path: dashboard/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Lint | |
| run: npm run lint | |
| - name: Type check | |
| run: npx tsc --noEmit | |
| - name: Run tests with coverage | |
| run: npm test -- --run --coverage | |
| - name: Security audit | |
| run: npm audit --audit-level=high | |
| continue-on-error: true | |
| bridge: | |
| name: Bridge Tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: bridge | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: "22" | |
| cache: "npm" | |
| cache-dependency-path: bridge/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Type check | |
| run: npx tsc --noEmit | |
| - name: Run tests with coverage | |
| run: npm test -- --run --coverage | |
| - name: Security audit | |
| run: npm audit --audit-level=high | |
| continue-on-error: true | |
| bridge-app: | |
| name: Bridge App Tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: bridge-app | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: "22" | |
| cache: "npm" | |
| cache-dependency-path: bridge-app/package-lock.json | |
| - name: Install bridge dependencies | |
| working-directory: bridge | |
| run: npm ci | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Type check | |
| run: npx tsc --noEmit | |
| - name: Run tests with coverage | |
| run: npm test -- --run --coverage | |
| - name: Security audit | |
| run: npm audit --audit-level=high | |
| continue-on-error: true | |
| kiosk: | |
| name: Kiosk WiFi Portal Tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: kiosk/wifi-portal | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up Python | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.11" | |
| - name: Install test dependencies | |
| run: pip install pytest | |
| - name: Run tests | |
| run: python -m pytest test_portal.py -q | |
| docker-build: | |
| name: Docker Build Smoke Test | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| # amd64-only, no push: verifies both images build on every PR/push without | |
| # paying for the multi-arch (arm64-under-QEMU) publish, which now runs only | |
| # on main/tag pushes in docker-publish.yml. The job NAME must stay exactly | |
| # "Docker Build Smoke Test" — main's branch protection requires that check. | |
| - name: Build backend image | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 | |
| with: | |
| context: ./server | |
| platforms: linux/amd64 | |
| push: false | |
| load: false | |
| cache-from: type=gha,scope=ci-api | |
| cache-to: type=gha,mode=max,scope=ci-api | |
| - name: Build frontend image | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 | |
| with: | |
| context: ./dashboard | |
| build-args: | | |
| NEXT_PUBLIC_API_URL=http://localhost:8000 | |
| platforms: linux/amd64 | |
| push: false | |
| load: false | |
| cache-from: type=gha,scope=ci-web | |
| cache-to: type=gha,mode=max,scope=ci-web |