mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 07:21:32 +02:00
such-gitea
985a05adf8
website_verify resolved every asset through get_user_by_pubkey_hash, but users.pubkey_hash only ever holds the BTC key's hash. On this backend only BTC could ever resolve; ltc, xmr, wow and grin were structurally impossible, and the failure was indistinguishable from an unregistered user, so the page told people to register with an extension they already had. That did not surface while smirk.cash pointed at the legacy backend, which resolves by asset key against its own database. It becomes the whole bug the moment the site is repointed here, so it has to land with that change, not after. get_user_by_pubkey_hash stays as the BTC fallback: of 95 users on this backend, 84 arrived through migrate-legacy, which imported identity without keys, and would otherwise stop resolving entirely. The rejection message is unchanged and still says nothing about whether an account exists.
106 lines
3.4 KiB
YAML
106 lines
3.4 KiB
YAML
name: ci
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
jobs:
|
|
secret-scan:
|
|
name: secret scan
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: key / seed material
|
|
run: ./tools/secret-scan.sh
|
|
- name: gitleaks (full history)
|
|
run: |
|
|
curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.18.4/gitleaks_8.18.4_linux_x64.tar.gz \
|
|
| tar -xz gitleaks
|
|
sudo mv gitleaks /usr/local/bin/
|
|
gitleaks detect --no-banner --redact --source .
|
|
|
|
openapi-drift:
|
|
name: openapi drift gate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- name: Regenerate the spec; fail if it drifts from committed openapi.json
|
|
run: |
|
|
cargo run --quiet --bin gen_openapi > /tmp/openapi.json
|
|
diff openapi.json /tmp/openapi.json
|
|
|
|
console-drift:
|
|
name: operator console drift gate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '22'
|
|
# Rebuild the admin-ui bundle from source (npm ci = reproducible from the
|
|
# lockfile) and fail if the committed admin-ui/dist drifts. rust-embed bakes
|
|
# dist into the server binary, so a stale dist would silently ship an old
|
|
# console. Same guarantee the openapi-drift job gives the API client.
|
|
- name: Rebuild admin-ui; fail if dist drifts from committed
|
|
working-directory: admin-ui
|
|
run: |
|
|
npm ci
|
|
npm run build
|
|
- name: git diff (dist must be committed and current)
|
|
run: git diff --exit-code -- admin-ui/dist
|
|
|
|
rust:
|
|
name: fmt / clippy / build / test / doc-test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
components: rustfmt, clippy
|
|
- uses: Swatinem/rust-cache@v2
|
|
- run: cargo fmt --all -- --check
|
|
- run: cargo clippy --all-targets -- -D warnings
|
|
- run: cargo build --all-targets --locked
|
|
- run: cargo test --locked
|
|
- run: cargo test --doc
|
|
|
|
integration:
|
|
name: integration (postgres)
|
|
runs-on: ubuntu-latest
|
|
services:
|
|
postgres:
|
|
image: postgres:16
|
|
env:
|
|
POSTGRES_USER: smirk
|
|
POSTGRES_PASSWORD: smirk
|
|
POSTGRES_DB: smirk_test
|
|
ports: ['5432:5432']
|
|
options: >-
|
|
--health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
|
|
env:
|
|
# Fundless L1 harness: a throwaway DB. The harness sets its own non-secret
|
|
# test JWT/peppers internally.
|
|
TEST_DATABASE_URL: postgres://smirk:smirk@localhost:5432/smirk_test
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
# landing is here, not only in the DB-less job, because the public stats
|
|
# block reads the database: without a DB those tests self-skip and the
|
|
# "no identifier on the public surface" assertion never actually runs.
|
|
- run: cargo test --locked --test auth_flow --test db_queries --test landing
|
|
|
|
supply-chain:
|
|
name: cargo-deny
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: EmbarkStudios/cargo-deny-action@v2
|