mirror of
https://github.com/Donkie/Spoolman.git
synced 2026-10-22 10:02:17 -05:00
Donkie
0f3a3918c1
101 tests covering the authentication system, run against a server with
SPOOLMAN_AUTH_ENABLED as a separate suite from the regression sweep.
Deliberately one SQLite variant rather than a fifth pass of the existing
four-database matrix. Nothing in spoolman/auth is database-specific, so
re-running the whole regression suite with auth on would quadruple the CI
bill to re-prove something none of those tests are about.
The tests live in tests_integration/tests_auth, a sibling of the regression
suite rather than a subdirectory of it, and the compose file mounts that
directory at the path the tester image's fixed entrypoint collects from. So
the auth suite runs exactly when asked and the regression runs can never
pick it up -- no entrypoint override, no collection guard, no way for the
two to interfere.
"sqlite-auth" is accepted by run.py but is not in the default target list,
so `poe itest` keeps meaning what it meant and `poe itest sqlite-auth` is
opt-in. CI gets its own small job for it, and the release gate now depends
on that job alongside the others.
Coverage:
test_unauthenticated every non-public route answers 401 without a
credential -- the black-box counterpart to the
import-time coverage assertion, and the test most
likely to catch a future route added without a gate
test_setup first claim succeeds, second is refused, username
stored lowercased
test_login success, wrong password, unknown user returning an
identical message, lockout with Retry-After, and
remember-me controlling cookie Max-Age
test_csrf cookie-authenticated writes need the header
test_levels the owner reaches read, edit and manage routes
test_anonymous_read the setting opens reads without opening writes, and
leaves the bulk exports closed
test_websocket rejection arrives as close code 4401, not as a failed
handshake -- the regression test for the uvicorn
behaviour that dictated the whole websocket design
test_password change requires the current password and takes effect
One test asserted that using 10 g leaves used_weight at 10. It is a running
total, and the spool was created with remaining_weight below the filament's
net weight, so it already stood at 500. Rewritten to assert the delta.
Verified by running both suites against a live server: 101 auth tests pass
with auth on, and the existing 372 regression tests still pass with auth off
and no test file edited.
591 lines
17 KiB
YAML
591 lines
17 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
tags:
|
|
- "v*"
|
|
pull_request:
|
|
branches:
|
|
- master
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: read
|
|
|
|
env:
|
|
GHCR_IMAGE: donkie/spoolman
|
|
|
|
jobs:
|
|
#
|
|
# Linting
|
|
#
|
|
style:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Install node
|
|
uses: actions/setup-node@v4.0.3
|
|
with:
|
|
node-version: '20'
|
|
|
|
- name: Install uv
|
|
uses: astral-sh/setup-uv@v7
|
|
with:
|
|
version: "0.9.26"
|
|
|
|
- name: "Set up Python"
|
|
uses: actions/setup-python@v6
|
|
with:
|
|
python-version-file: "pyproject.toml"
|
|
|
|
- name: Install lefthook
|
|
run: uv add --dev lefthook
|
|
|
|
- name: Install client dependencies
|
|
run: |
|
|
cd client
|
|
npm ci
|
|
|
|
- name: Run pre-commit
|
|
run: uv run lefthook run ci
|
|
#
|
|
# Build the Spoolman client for baking into the docker images
|
|
# This is done on native hardware to speed things up, vite is very slow on emulated hardware
|
|
#
|
|
build-client:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Install node
|
|
uses: actions/setup-node@v4.0.3
|
|
with:
|
|
node-version: '20'
|
|
|
|
- name: Install uv
|
|
uses: astral-sh/setup-uv@v7
|
|
with:
|
|
version: "0.9.26"
|
|
|
|
- name: "Set up Python"
|
|
uses: actions/setup-python@v6
|
|
with:
|
|
python-version-file: "pyproject.toml"
|
|
|
|
- name: Install client dependencies
|
|
run: |
|
|
cd client
|
|
npm ci
|
|
|
|
- name: Build
|
|
run: |
|
|
cd client
|
|
rm -f .env && echo "VITE_APIURL=/api/v1" > .env.production
|
|
npm run build
|
|
|
|
# Build the new Svelte client (client_v2), served by default at runtime.
|
|
# No VITE_APIURL is set: the client resolves the API relative to its base path.
|
|
- name: Install client_v2 dependencies
|
|
run: |
|
|
cd client_v2
|
|
npm ci
|
|
|
|
- name: Build client_v2
|
|
run: |
|
|
cd client_v2
|
|
npm run build
|
|
|
|
- name: Write build info
|
|
run: |
|
|
echo "GIT_COMMIT=$(git rev-parse --short HEAD)" > build.txt
|
|
echo "BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")" >> build.txt
|
|
|
|
# Remove client sources and keep only the built output for each client
|
|
- name: Clean
|
|
run: |
|
|
mv client/dist dist
|
|
rm -rf client
|
|
mkdir client
|
|
mv dist client/dist
|
|
mv client_v2/build build_v2
|
|
rm -rf client_v2
|
|
mkdir client_v2
|
|
mv build_v2 client_v2/build
|
|
rm -rf .git
|
|
rm -rf .venv
|
|
|
|
- name: Fix permissions
|
|
run: |
|
|
chmod +x scripts/*.sh
|
|
|
|
- name: Upload client Spoolman artifact
|
|
uses: actions/upload-artifact@v4.4.0
|
|
with:
|
|
name: client
|
|
path: client/dist
|
|
|
|
- name: Upload client_v2 Spoolman artifact
|
|
uses: actions/upload-artifact@v4.4.0
|
|
with:
|
|
name: client_v2
|
|
path: client_v2/build
|
|
|
|
- name: Upload full Spoolman artifact
|
|
uses: actions/upload-artifact@v4.4.0
|
|
with:
|
|
include-hidden-files: true
|
|
name: spoolman
|
|
path: .
|
|
#
|
|
# Build native image for integration tests
|
|
#
|
|
build-amd64:
|
|
needs: [build-client]
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
packages: write
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Download client
|
|
uses: actions/download-artifact@v4.1.7
|
|
with:
|
|
name: client
|
|
path: client/dist
|
|
|
|
- name: Download client_v2
|
|
uses: actions/download-artifact@v4.1.7
|
|
with:
|
|
name: client_v2
|
|
path: client_v2/build
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3.6.1
|
|
|
|
- name: Log in to the Github Container registry
|
|
uses: docker/login-action@v3.3.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Build Spoolman
|
|
if: ${{ github.event_name != 'pull_request' }}
|
|
uses: docker/build-push-action@v6.7.0
|
|
with:
|
|
context: .
|
|
tags: ${{ env.GHCR_IMAGE }}:test
|
|
outputs: type=docker,dest=/tmp/spoolman.tar
|
|
cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_IMAGE }}:buildcache-amd64
|
|
cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_IMAGE }}:buildcache-amd64,mode=max
|
|
|
|
# Separate build for pull requests since PRs dont have access to store cache
|
|
- name: Build Spoolman (PR)
|
|
if: ${{ github.event_name == 'pull_request' }}
|
|
uses: docker/build-push-action@v6.7.0
|
|
with:
|
|
context: .
|
|
tags: ${{ env.GHCR_IMAGE }}:test
|
|
outputs: type=docker,dest=/tmp/spoolman.tar
|
|
cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_IMAGE }}:buildcache-amd64
|
|
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@v4.4.0
|
|
with:
|
|
name: spoolman-image
|
|
path: /tmp/spoolman.tar
|
|
#
|
|
# Build tester image for integration tests
|
|
#
|
|
build-tester:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
packages: write
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3.6.1
|
|
|
|
- name: Log in to the Github Container registry
|
|
uses: docker/login-action@v3.3.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Build Spoolman Tester
|
|
if: ${{ github.event_name != 'pull_request' }}
|
|
uses: docker/build-push-action@v6.7.0
|
|
with:
|
|
context: ./tests_integration
|
|
tags: ${{ env.GHCR_IMAGE }}-tester:latest
|
|
outputs: type=docker,dest=/tmp/spoolman-tester.tar
|
|
cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_IMAGE }}:buildcache-tester
|
|
cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_IMAGE }}:buildcache-tester,mode=max
|
|
|
|
# Separate build for pull requests since PRs dont have access to store cache
|
|
- name: Build Spoolman Tester (PR)
|
|
if: ${{ github.event_name == 'pull_request' }}
|
|
uses: docker/build-push-action@v6.7.0
|
|
with:
|
|
context: ./tests_integration
|
|
tags: ${{ env.GHCR_IMAGE }}-tester:latest
|
|
outputs: type=docker,dest=/tmp/spoolman-tester.tar
|
|
cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_IMAGE }}:buildcache-tester
|
|
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@v4.4.0
|
|
with:
|
|
name: spoolman-tester-image
|
|
path: /tmp/spoolman-tester.tar
|
|
#
|
|
# Perform integration tests
|
|
#
|
|
test:
|
|
needs: [build-amd64, build-tester]
|
|
strategy:
|
|
matrix:
|
|
dbtype: ["postgres", "sqlite", "mariadb", "cockroachdb"]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Download built images
|
|
uses: actions/download-artifact@v4.1.7
|
|
with:
|
|
pattern: spoolman*-image
|
|
path: /tmp
|
|
|
|
- name: Load built images
|
|
run: |
|
|
docker load --input /tmp/spoolman-image/spoolman.tar
|
|
docker load --input /tmp/spoolman-tester-image/spoolman-tester.tar
|
|
|
|
- name: Perform integration tests
|
|
uses: hoverkraft-tech/compose-action@v2.0.1
|
|
with:
|
|
compose-file: "./tests_integration/docker-compose-${{ matrix.dbtype }}.yml"
|
|
up-flags: "--abort-on-container-exit"
|
|
down-flags: "--volumes"
|
|
#
|
|
# Perform authentication tests
|
|
#
|
|
# Deliberately its own job rather than another entry in the matrix above. That matrix
|
|
# re-runs the whole regression suite per database; adding auth to it would run those
|
|
# same tests a fifth time to re-prove something none of them are about. Nothing in
|
|
# spoolman/auth is database-specific, so one SQLite pass over the auth suite is the
|
|
# whole cost.
|
|
#
|
|
test-auth:
|
|
needs: [build-amd64, build-tester]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Download built images
|
|
uses: actions/download-artifact@v4.1.7
|
|
with:
|
|
pattern: spoolman*-image
|
|
path: /tmp
|
|
|
|
- name: Load built images
|
|
run: |
|
|
docker load --input /tmp/spoolman-image/spoolman.tar
|
|
docker load --input /tmp/spoolman-tester-image/spoolman-tester.tar
|
|
|
|
- name: Perform authentication tests
|
|
uses: hoverkraft-tech/compose-action@v2.0.1
|
|
with:
|
|
compose-file: "./tests_integration/docker-compose-sqlite-auth.yml"
|
|
up-flags: "--abort-on-container-exit"
|
|
down-flags: "--volumes"
|
|
#
|
|
# Perform frontend (browser) integration tests against the real image
|
|
#
|
|
test-frontend:
|
|
needs: [build-amd64]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Download built image
|
|
uses: actions/download-artifact@v4.1.7
|
|
with:
|
|
name: spoolman-image
|
|
path: /tmp/spoolman-image
|
|
|
|
- name: Load built image
|
|
run: docker load --input /tmp/spoolman-image/spoolman.tar
|
|
|
|
- name: Install node
|
|
uses: actions/setup-node@v4.0.3
|
|
with:
|
|
node-version: '20'
|
|
|
|
- name: Install Playwright
|
|
run: |
|
|
cd tests_frontend
|
|
npm ci
|
|
npx playwright install --with-deps chromium
|
|
|
|
- name: Start Spoolman
|
|
run: docker compose -f tests_frontend/docker-compose.yml up -d --wait
|
|
|
|
- name: Run frontend integration tests
|
|
run: |
|
|
cd tests_frontend
|
|
npx playwright test
|
|
|
|
- name: Dump Spoolman logs on failure
|
|
if: failure()
|
|
run: docker compose -f tests_frontend/docker-compose.yml logs spoolman
|
|
|
|
- name: Upload Playwright report
|
|
if: ${{ !cancelled() }}
|
|
uses: actions/upload-artifact@v4.4.0
|
|
with:
|
|
name: playwright-report
|
|
path: tests_frontend/playwright-report
|
|
retention-days: 7
|
|
|
|
- name: Stop Spoolman
|
|
if: always()
|
|
run: docker compose -f tests_frontend/docker-compose.yml down -v
|
|
#
|
|
# Build arm64 image
|
|
# Don't run this for pull requests
|
|
# Only push to buildcache and let release job push to registry
|
|
#
|
|
build-arm64:
|
|
if: ${{ github.event_name != 'pull_request' }}
|
|
needs: [build-client]
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
packages: write
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Download client
|
|
uses: actions/download-artifact@v4.1.7
|
|
with:
|
|
name: client
|
|
path: client/dist
|
|
|
|
- name: Download client_v2
|
|
uses: actions/download-artifact@v4.1.7
|
|
with:
|
|
name: client_v2
|
|
path: client_v2/build
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3.2.0
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3.6.1
|
|
|
|
- name: Log in to the Github Container registry
|
|
uses: docker/login-action@v3.3.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Build and cache Docker image
|
|
uses: docker/build-push-action@v6.7.0
|
|
with:
|
|
context: .
|
|
platforms: linux/arm64
|
|
cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_IMAGE }}:buildcache-arm64
|
|
cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_IMAGE }}:buildcache-arm64,mode=max
|
|
#
|
|
# Build arm/v7 image
|
|
# Don't run this for pull requests
|
|
# Only push to buildcache and let release job push to registry
|
|
#
|
|
build-armv7:
|
|
if: ${{ github.event_name != 'pull_request' }}
|
|
needs: [build-client]
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
packages: write
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Download client
|
|
uses: actions/download-artifact@v4.1.7
|
|
with:
|
|
name: client
|
|
path: client/dist
|
|
|
|
- name: Download client_v2
|
|
uses: actions/download-artifact@v4.1.7
|
|
with:
|
|
name: client_v2
|
|
path: client_v2/build
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3.2.0
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3.6.1
|
|
|
|
- name: Log in to the Github Container registry
|
|
uses: docker/login-action@v3.3.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Build and cache Docker image
|
|
uses: docker/build-push-action@v6.7.0
|
|
with:
|
|
context: .
|
|
platforms: linux/arm/v7
|
|
cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_IMAGE }}:buildcache-armv7
|
|
cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_IMAGE }}:buildcache-armv7,mode=max
|
|
#
|
|
# Release images GHCR and Docker Hub if tests pass
|
|
# Don't run this for pull requests
|
|
#
|
|
publish-images:
|
|
if: ${{ github.event_name != 'pull_request' }}
|
|
needs: [test, test-auth, test-frontend, build-amd64, build-arm64, build-armv7, style, build-client]
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
packages: write
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Download client
|
|
uses: actions/download-artifact@v4.1.7
|
|
with:
|
|
name: client
|
|
path: client/dist
|
|
|
|
- name: Download client_v2
|
|
uses: actions/download-artifact@v4.1.7
|
|
with:
|
|
name: client_v2
|
|
path: client_v2/build
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3.2.0
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3.6.1
|
|
|
|
- name: Log in to the Github Container registry
|
|
uses: docker/login-action@v3.3.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Extract metadata (tags, labels) for GHCR
|
|
id: meta-ghcr
|
|
uses: docker/metadata-action@v5.5.1
|
|
with:
|
|
images: |
|
|
ghcr.io/${{ env.GHCR_IMAGE }}
|
|
tags: |
|
|
type=edge
|
|
type=semver,pattern={{version}}
|
|
type=semver,pattern={{major}}.{{minor}}
|
|
type=semver,pattern={{major}}
|
|
|
|
- name: Extract metadata (tags, labels) for Docker Hub
|
|
id: meta-dh
|
|
uses: docker/metadata-action@v5.5.1
|
|
with:
|
|
images: |
|
|
${{ vars.REMOTE_REGISTRY_URL }}/${{ vars.REMOTE_REGISTRY_NAMESPACE }}/${{ vars.REMOTE_REGISTRY_REPOSITORY }}
|
|
tags: |
|
|
type=edge
|
|
type=semver,pattern={{version}}
|
|
type=semver,pattern={{major}}.{{minor}}
|
|
type=semver,pattern={{major}}
|
|
|
|
- name: Log in to DockerHub
|
|
uses: docker/login-action@v3.3.0
|
|
with:
|
|
registry: ${{ vars.REMOTE_REGISTRY_URL }}
|
|
username: ${{ secrets.REMOTE_REGISTRY_USERNAME }}
|
|
password: ${{ secrets.REMOTE_REGISTRY_PASSWORD }}
|
|
|
|
- name: Store git commit and build date
|
|
run: |
|
|
echo "GIT_COMMIT=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
|
|
echo "BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")" >> "$GITHUB_ENV"
|
|
|
|
- name: Build and push Docker images
|
|
uses: docker/build-push-action@v6.7.0
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64,linux/arm64,linux/arm/v7
|
|
push: true
|
|
tags: |
|
|
${{ steps.meta-ghcr.outputs.tags }}
|
|
${{ steps.meta-dh.outputs.tags }}
|
|
labels: ${{ steps.meta-ghcr.outputs.labels }}
|
|
build-args: |
|
|
GIT_COMMIT
|
|
BUILD_DATE
|
|
cache-from: |
|
|
type=registry,ref=ghcr.io/${{ env.GHCR_IMAGE }}:buildcache-amd64
|
|
type=registry,ref=ghcr.io/${{ env.GHCR_IMAGE }}:buildcache-arm64
|
|
type=registry,ref=ghcr.io/${{ env.GHCR_IMAGE }}:buildcache-armv7
|
|
#
|
|
# Create Github Release if CI was triggered by a tag
|
|
#
|
|
publish-release:
|
|
if: ${{ (github.event_name != 'pull_request') && startsWith(github.event.ref, 'refs/tags/v') }}
|
|
needs: [publish-images]
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Download built spoolman
|
|
uses: actions/download-artifact@v4.1.7
|
|
with:
|
|
name: spoolman
|
|
path: /tmp/spoolman
|
|
|
|
- name: Generate release info
|
|
run: |
|
|
cd /tmp/spoolman
|
|
echo '{
|
|
"project_name": "Spoolman",
|
|
"project_owner": "Donkie",
|
|
"version": "${{ github.ref_name }}"
|
|
}' > release_info.json
|
|
|
|
- name: Zip
|
|
run: |
|
|
cd /tmp/spoolman
|
|
zip -r spoolman.zip .
|
|
|
|
- name: Create release and upload build
|
|
uses: softprops/action-gh-release@v1
|
|
id: create-release
|
|
with:
|
|
draft: true
|
|
name: ${{ github.ref_name }}
|
|
tag_name: ${{ github.ref_name }}
|
|
files: /tmp/spoolman/spoolman.zip
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
body: "⚠️ TODO ⚠️"
|