Omar SobhandClaude Fable 5
e65bcd4130
- scripts/netpol-cluster.sh: a kind cluster with Calico (default CNI disabled) — the only way to PROVE the §15 default-deny NetworkPolicy, since kindnet accepts the object but never enforces it. New live test on that cluster: outbound connect to 1.1.1.1 dropped, DNS egress dropped, while API-server exec keeps working (not pod network). Kernel-level enforcement of the sandbox egress claim, demonstrated - K8sDriver::connect_with_context: pin a kubeconfig context instead of ambient. The whole k8s suite now pins its cluster explicitly — the netpol cluster's creation had silently switched the current context and stranded the seccomp test on the wrong cluster (fixed and made impossible to recur) - CI: netpol-cluster up + calico egress test in the sandbox-k8s job - Visual-regression lock (plan P6): @visual Playwright spec with animation-disabled, masked-dynamic-region screenshots of login, workspace home, chat welcome, computer panel, credits; darwin baselines committed (5 PNGs); CI excludes @visual until linux baselines are generated there. Full local suite: 33 journeys 165 Rust tests + 5 live kind tests (2 clusters) + 33 journeys. Co-Authored-By: Claude Fable 5 <[email protected]>
109 lines
3.2 KiB
YAML
109 lines
3.2 KiB
YAML
name: ci
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
jobs:
|
|
gates:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: File size budget (1250 lines)
|
|
run: ./ci/check-loc.sh
|
|
- name: No placeholder markers
|
|
run: ./ci/check-no-placeholders.sh
|
|
- name: Compose config validates
|
|
run: POSTGRES_PASSWORD=ci docker compose -f deploy/compose/docker-compose.yml config -q
|
|
- name: Helm chart lints and renders the safety topology
|
|
run: ./ci/check-helm.sh
|
|
|
|
rust:
|
|
runs-on: ubuntu-latest
|
|
needs: gates
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
toolchain: 1.96.0
|
|
components: rustfmt, clippy
|
|
- uses: Swatinem/rust-cache@v2
|
|
- name: Format
|
|
run: cargo fmt --all --check
|
|
- name: Clippy
|
|
run: cargo clippy --workspace --all-targets -- -D warnings
|
|
- name: Test
|
|
run: cargo test --workspace
|
|
- name: Air-gapped installer verify path
|
|
run: ./ci/test-install.sh
|
|
|
|
sandbox-k8s:
|
|
runs-on: ubuntu-latest
|
|
needs: gates
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- name: Create kind cluster
|
|
uses: helm/kind-action@v1
|
|
with:
|
|
cluster_name: clawmates-test
|
|
- name: K8s sandbox kernel assertions
|
|
run: cargo test -p cm-sandbox --features k8s-tests --test k8s_security
|
|
- name: Calico cluster (NetworkPolicy enforcement)
|
|
run: ./scripts/netpol-cluster.sh up
|
|
- name: Egress default-deny enforced in the kernel
|
|
run: cargo test -p cm-sandbox --features k8s-tests --test k8s_security calico
|
|
|
|
frontend:
|
|
runs-on: ubuntu-latest
|
|
needs: gates
|
|
defaults:
|
|
run:
|
|
working-directory: frontend
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
- name: Install
|
|
run: npm ci
|
|
if: ${{ hashFiles('frontend/package-lock.json') != '' }}
|
|
- name: Lint
|
|
run: npm run lint
|
|
if: ${{ hashFiles('frontend/package-lock.json') != '' }}
|
|
- name: Typecheck
|
|
run: npm run typecheck
|
|
if: ${{ hashFiles('frontend/package-lock.json') != '' }}
|
|
- name: Unit and component tests
|
|
run: npm test
|
|
if: ${{ hashFiles('frontend/package-lock.json') != '' }}
|
|
|
|
e2e:
|
|
runs-on: ubuntu-latest
|
|
needs: [rust, frontend]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
toolchain: 1.96.0
|
|
- uses: Swatinem/rust-cache@v2
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
- name: Install frontend dependencies
|
|
working-directory: frontend
|
|
run: npm ci
|
|
- name: Install Playwright browsers
|
|
working-directory: frontend
|
|
run: npx playwright install --with-deps chromium
|
|
- name: Run end-to-end journeys against the real backend
|
|
working-directory: frontend
|
|
run: npx playwright test --grep-invert "@visual"
|
|
- uses: actions/upload-artifact@v4
|
|
if: failure()
|
|
with:
|
|
name: playwright-traces
|
|
path: frontend/test-results/
|