feat(security,ci,ui): harden CI/CD, LuCI ACL, low-space updates and mobile layout
- ci: make frontend CI read-only with strict diff check and deterministic calls.json - ci: pin external GitHub Actions in workflows to immutable commit SHAs - ci: add openwrt-e2e blocking gate job running docker_e2e_test.sh - fix(diagnostic): fix contstants.ts typo and update all 13 import sites - fix(acl): remove unused /bin/busybox exec from rpcd ACL and add regression test - feat(updates): add low-space update fallback when creating sing-box.old is impossible - fix(routes): preserve dedicated Discord gateway subnets (162.159.128.0/21) - feat(ui): implement responsive auto-fit grid and mobile modal viewport bounds - test: add viewport regression test suite in vitest
This commit is contained in:
Dushnilin
@@ -34,7 +34,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v5.0.0
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
@@ -71,3 +71,18 @@ jobs:
|
||||
! -name 'ucode_syntax_lint.sh' \
|
||||
-print0 | xargs -0 -n1 -P4 bash
|
||||
|
||||
openwrt-e2e:
|
||||
name: OpenWrt Docker E2E
|
||||
needs: backend-checks
|
||||
runs-on: ubuntu-24.04
|
||||
timeout-minutes: 60
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Run OpenWrt E2E suite
|
||||
shell: bash
|
||||
run: bash tests/docker_e2e_test.sh
|
||||
|
||||
@@ -25,7 +25,7 @@ jobs:
|
||||
version: ${{ steps.version.outputs.version }}
|
||||
commitish: ${{ steps.version.outputs.commitish }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- id: version
|
||||
@@ -50,7 +50,7 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
needs: preparation
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
@@ -63,7 +63,7 @@ jobs:
|
||||
ls -la "$PWD/filtered-bin/release"
|
||||
|
||||
- name: Upload build artifacts
|
||||
uses: actions/upload-artifact@v4
|
||||
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
|
||||
with:
|
||||
name: release-files-${{ needs.preparation.outputs.version }}
|
||||
path: ./filtered-bin/release/*
|
||||
@@ -77,12 +77,12 @@ jobs:
|
||||
- preparation
|
||||
- build
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- name: Create release dir
|
||||
run: mkdir -p ./filtered-bin/release
|
||||
|
||||
- name: Download release artifacts
|
||||
uses: actions/download-artifact@v4
|
||||
uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
|
||||
with:
|
||||
name: release-files-${{ needs.preparation.outputs.version }}
|
||||
path: ./filtered-bin/release
|
||||
@@ -118,7 +118,7 @@ jobs:
|
||||
|
||||
- name: Release on tag push
|
||||
if: ${{ github.event_name == 'push' }}
|
||||
uses: softprops/action-gh-release@v2.4.0
|
||||
uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
|
||||
with:
|
||||
files: ./filtered-bin/release/*
|
||||
tag_name: ${{ github.ref_name }}
|
||||
@@ -133,7 +133,7 @@ jobs:
|
||||
|
||||
- name: Release on workflow dispatch
|
||||
if: ${{ github.event_name == 'workflow_dispatch' }}
|
||||
uses: softprops/action-gh-release@v2.4.0
|
||||
uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
|
||||
with:
|
||||
files: ./filtered-bin/release/*
|
||||
tag_name: ${{ needs.preparation.outputs.version }}
|
||||
|
||||
@@ -7,6 +7,14 @@ on:
|
||||
pull_request:
|
||||
paths:
|
||||
- 'fe-app-tachyon/**'
|
||||
- 'luci-app-tachyon/po/**'
|
||||
- '.github/workflows/frontend-ci.yml'
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'fe-app-tachyon/**'
|
||||
- 'luci-app-tachyon/po/**'
|
||||
- '.github/workflows/frontend-ci.yml'
|
||||
|
||||
jobs:
|
||||
@@ -19,17 +27,15 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v5.0.0
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v5.0.0
|
||||
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
||||
with:
|
||||
node-version: '22'
|
||||
cache: npm
|
||||
cache-dependency-path: fe-app-tachyon/package-lock.json
|
||||
|
||||
# The project uses npm (package-lock.json); yarn.lock does not exist, so
|
||||
# a yarn install here would resolve fresh versions on every run.
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
@@ -48,6 +54,24 @@ jobs:
|
||||
- name: Run tests
|
||||
run: npm test -- --run
|
||||
|
||||
- name: Check translation extraction
|
||||
id: locale_extract
|
||||
run: |
|
||||
npm run locales:extract-calls
|
||||
if ! git diff --exit-code -- locales/calls.json; then
|
||||
echo "::error::Translation call index is stale. Run 'npm run locales:extract-calls' locally."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check distributed locales
|
||||
id: locale_distribute
|
||||
run: |
|
||||
npm run locales:distribute
|
||||
if ! git diff --exit-code -- ../luci-app-tachyon/po; then
|
||||
echo "::error::LuCI locale copies are stale. Run 'npm run locales:distribute' locally."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Build project
|
||||
id: build
|
||||
run: |
|
||||
@@ -62,8 +86,8 @@ jobs:
|
||||
run: |
|
||||
echo "## Frontend CI Results" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- ✅ Format check: ${{ steps.format.outcome }}" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- ✅ Lint check: ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- ✅ Tests: ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- ✅ Build: ${{ steps.build.outcome }}" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- Format check: ${{ steps.format.outcome }}" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- Translation extraction: ${{ steps.locale_extract.outcome }}" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- Locale distribution: ${{ steps.locale_distribute.outcome }}" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- Overall lint/tests status: ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- Build: ${{ steps.build.outcome }}" >> $GITHUB_STEP_SUMMARY
|
||||
|
||||
@@ -39,7 +39,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v5.0.0
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
|
||||
- name: Install ShellCheck
|
||||
run: |
|
||||
|
||||
Reference in New Issue
Block a user