fix(server): bake issuer public key, fail closed on enterprise gate (H2) #73
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| jobs: | |
| verify: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm build | |
| - run: pnpm lint | |
| - run: pnpm typecheck | |
| - run: pnpm test:unit | |
| # Non-blocking: a newly-published advisory on an untouched transitive dep must not red an | |
| # unrelated PR. It still runs and surfaces (warning) so the advisory is visible; act on it via | |
| # a dependency bump / pnpm override, not by blocking the build. | |
| - name: Security audit (advisory drift — non-blocking) | |
| run: pnpm audit --audit-level high | |
| continue-on-error: true | |
| - run: pnpm format:check | |
| e2e: | |
| runs-on: ubuntu-latest | |
| needs: verify | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm build | |
| - run: pnpm --filter @reticlehq/e2e --fail-if-no-match exec playwright install --with-deps chromium | |
| # Headless Chromium + a multi-service boot flakes on shared runners (timing, resource | |
| # contention). Retry with a clean slate between attempts so a transient flake doesn't red CI; | |
| # a real regression still fails (it fails every attempt). | |
| - name: Integration suite (real-Chromium BrowserPool tests) | |
| run: | | |
| for attempt in 1 2 3; do | |
| echo "::group::integration attempt $attempt" | |
| if pnpm test:integration; then echo "::endgroup::"; exit 0; fi | |
| echo "::endgroup::" | |
| echo "attempt $attempt failed — cleaning up before retry" | |
| pkill -f "cli.js mcp" || true; pkill -f "cli.js _daemon" || true; pkill -f chrome-headless || true | |
| sleep 3 | |
| done | |
| echo "integration suite failed after 3 attempts"; exit 1 | |
| - name: Run e2e battery (boots api+demo+next-smoke, drives Reticle headless) | |
| run: | | |
| for attempt in 1 2; do | |
| echo "::group::e2e attempt $attempt" | |
| if pnpm --filter @reticlehq/e2e --fail-if-no-match run e2e:ci; then echo "::endgroup::"; exit 0; fi | |
| echo "::endgroup::" | |
| echo "attempt $attempt failed — cleaning up before retry" | |
| pkill -f "cli.js mcp" || true; pkill -f "cli.js _daemon" || true; pkill -f chrome-headless || true | |
| pkill -f "vite" || true; pkill -f "apps/api/server.mjs" || true; sleep 3 | |
| done | |
| echo "e2e battery failed after 2 attempts"; exit 1 | |
| - name: Upload server logs on failure | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: e2e-server-logs | |
| path: /tmp/e2e-*.log | |
| if-no-files-found: ignore | |
| retention-days: 7 |