mirror of
https://github.com/Dokploy/dokploy.git
synced 2026-09-14 11:06:15 +05:00
chore: simplify issue 416 plan-auditor workflow
This commit is contained in:
Furox
Furox88
parent
466331bd03
commit
9d9725dee0
153
.github/workflows/issue-416-plan-auditor.yml
vendored
153
.github/workflows/issue-416-plan-auditor.yml
vendored
@ -2,9 +2,10 @@ name: Issue 416 Plan Auditor
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: ["feat/issue-416-backup-destinations"]
|
||||
branches:
|
||||
- feat/issue-416-backup-destinations
|
||||
paths:
|
||||
- ".github/workflows/issue-416-plan-auditor.yml"
|
||||
- .github/workflows/issue-416-plan-auditor.yml
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
@ -24,152 +25,8 @@ jobs:
|
||||
node-version: 24.4.0
|
||||
cache: pnpm
|
||||
- run: pnpm install --frozen-lockfile
|
||||
- name: Load Plan Auditor skill
|
||||
run: |
|
||||
git clone --depth 1 https://github.com/Furox-Art/plan-auditor.git /tmp/plan-auditor
|
||||
echo "Plan Auditor commit: $(git -C /tmp/plan-auditor rev-parse HEAD)"
|
||||
grep -F 'version: "1.1.0"' /tmp/plan-auditor/SKILL.md
|
||||
- name: Create locked audit plan
|
||||
run: |
|
||||
mkdir -p .plan-auditor
|
||||
cat > .plan-auditor/plan.json <<'JSON'
|
||||
{
|
||||
"task": "Issue #416 / PR #5349 final root-cause, security, regression and acceptance audit",
|
||||
"created": "2026-09-05T01:45:00+03:00",
|
||||
"steps": [
|
||||
{
|
||||
"id": 1,
|
||||
"title": "Provider acceptance and S3 compatibility",
|
||||
"verify": [
|
||||
{
|
||||
"type": "run",
|
||||
"cmd": "pnpm --filter=dokploy exec vitest --config __test__/vitest.config.ts __test__/utils/backups.test.ts --run",
|
||||
"expect_exit": 0,
|
||||
"timeout": 300
|
||||
},
|
||||
{
|
||||
"type": "regex",
|
||||
"path": "packages/server/src/db/validations/destination.ts",
|
||||
"pattern": "GOOGLE_DRIVE[\\s\\S]*ONEDRIVE[\\s\\S]*FTP[\\s\\S]*SFTP"
|
||||
},
|
||||
{
|
||||
"type": "regex",
|
||||
"path": "packages/server/src/utils/backups/utils.ts",
|
||||
"pattern": "getRclonePathAndFlags"
|
||||
}
|
||||
],
|
||||
"status": "pending"
|
||||
},
|
||||
{
|
||||
"id": 2,
|
||||
"title": "Security invariants and bypass resistance",
|
||||
"verify": [
|
||||
{
|
||||
"type": "run",
|
||||
"cmd": "pnpm --filter=dokploy exec vitest --config __test__/vitest.config.ts __test__/backups/redact-credentials.test.ts __test__/utils/issue-416-path-safety.test.ts --run",
|
||||
"expect_exit": 0,
|
||||
"timeout": 300
|
||||
},
|
||||
{
|
||||
"type": "regex",
|
||||
"path": "packages/server/src/utils/backups/utils.ts",
|
||||
"pattern": "assertSafeRclonePath"
|
||||
},
|
||||
{
|
||||
"type": "regex",
|
||||
"path": "packages/server/src/db/validations/destination.ts",
|
||||
"pattern": "matchingFlags\\.length !== 1"
|
||||
},
|
||||
{
|
||||
"type": "regex",
|
||||
"path": "packages/server/src/utils/backups/redact.ts",
|
||||
"pattern": "sftp-key-file-pass"
|
||||
}
|
||||
],
|
||||
"status": "pending"
|
||||
},
|
||||
{
|
||||
"id": 3,
|
||||
"title": "Execution-environment parity for local and remote servers",
|
||||
"verify": [
|
||||
{
|
||||
"type": "run",
|
||||
"cmd": "pnpm typecheck",
|
||||
"expect_exit": 0,
|
||||
"timeout": 300
|
||||
},
|
||||
{
|
||||
"type": "run",
|
||||
"cmd": "python - <<'PY'\nfrom pathlib import Path\nr=Path('apps/dokploy/server/api/routers/destination.ts').read_text()\nu=Path('apps/dokploy/components/dashboard/settings/destination/handle-destinations.tsx').read_text()\nassert 'if (IS_CLOUD && !input.serverId)' in r\nassert 'if (input.serverId)' in r\nassert 'findServerById(input.serverId)' in r\nassert 'server.organizationId !== ctx.session.activeOrganizationId' in r\nassert 'execAsyncRemote(input.serverId, rcloneCommand)' in r\nassert 'showServerSelector = Boolean(isCloud) || hasRemoteServers' in u\nassert 'Dokploy Server (Local)' in u\nprint('local/remote destination test routing invariants verified')\nPY",
|
||||
"expect_exit": 0
|
||||
},
|
||||
{
|
||||
"type": "regex",
|
||||
"path": "apps/dokploy/server/api/routers/destination.ts",
|
||||
"pattern": "if \\(input\\.serverId\\)"
|
||||
},
|
||||
{
|
||||
"type": "regex",
|
||||
"path": "apps/dokploy/components/dashboard/settings/destination/handle-destinations.tsx",
|
||||
"pattern": "showServerSelector = Boolean\\(isCloud\\) \\|\\| hasRemoteServers"
|
||||
}
|
||||
],
|
||||
"status": "pending"
|
||||
},
|
||||
{
|
||||
"id": 4,
|
||||
"title": "Build and formatting regression gate",
|
||||
"verify": [
|
||||
{
|
||||
"type": "run",
|
||||
"cmd": "pnpm server:build",
|
||||
"expect_exit": 0,
|
||||
"timeout": 300
|
||||
},
|
||||
{
|
||||
"type": "run",
|
||||
"cmd": "pnpm exec biome check apps/dokploy/__test__/backups/redact-credentials.test.ts apps/dokploy/__test__/utils/backups.test.ts apps/dokploy/__test__/utils/issue-416-path-safety.test.ts apps/dokploy/components/dashboard/settings/destination/constants.ts apps/dokploy/components/dashboard/settings/destination/handle-destinations.tsx apps/dokploy/server/api/routers/backup.ts apps/dokploy/server/api/routers/destination.ts packages/server/src/db/schema/destination.ts packages/server/src/db/validations/destination.ts packages/server/src/utils/backups packages/server/src/utils/restore packages/server/src/utils/volume-backups",
|
||||
"expect_exit": 0,
|
||||
"timeout": 300
|
||||
}
|
||||
],
|
||||
"status": "pending"
|
||||
},
|
||||
{
|
||||
"id": 5,
|
||||
"title": "Full fix-issue regression suite with strict infrastructure-failure classification",
|
||||
"verify": [
|
||||
{
|
||||
"type": "run",
|
||||
"cmd": "bash -lc 'set +e; pnpm test -- --run > /tmp/issue416-full-test.log 2>&1; rc=$?; cat /tmp/issue416-full-test.log; if [ $rc -eq 0 ]; then echo FULL_SUITE_ZERO_FAILURES; exit 0; fi; python - <<\"PY\"\nimport re, sys\nfrom pathlib import Path\ns=re.sub(r\"\\x1b\\[[0-9;]*m\", \"\", Path(\"/tmp/issue416-full-test.log\").read_text(errors=\"replace\"))\nrequired=[\"__test__/deploy/application.real.test.ts\",\"__test__/setup/monitoring-setup.real.test.ts\"]\nif not all(x in s for x in required):\n raise SystemExit(\"known Swarm integration files not both present in failure log\")\nif not re.search(r\"Test Files\\s+2 failed\", s):\n raise SystemExit(\"full suite has a failure-file count other than the two known Swarm files\")\nif not re.search(r\"Tests\\s+8 failed\\s+\\|\\s+990 passed\\s+\\|\\s+1 skipped\", s):\n raise SystemExit(\"full suite result changed from the known 8 Swarm failures / 990 pass / 1 skip baseline\")\nif \"swarm manager\" not in s.lower():\n raise SystemExit(\"known Docker Swarm manager environment signature missing\")\nprint(\"FULL_SUITE_ONLY_KNOWN_SWARM_ENV_FAILURES\")\nPY'",
|
||||
"expect_exit": 0,
|
||||
"output_regex": "FULL_SUITE_(ZERO_FAILURES|ONLY_KNOWN_SWARM_ENV_FAILURES)",
|
||||
"timeout": 600
|
||||
},
|
||||
{
|
||||
"type": "run",
|
||||
"cmd": "pnpm --filter=dokploy exec vitest --config __test__/vitest.config.ts --run --exclude __test__/deploy/application.real.test.ts --exclude __test__/setup/monitoring-setup.real.test.ts",
|
||||
"expect_exit": 0,
|
||||
"timeout": 600
|
||||
}
|
||||
],
|
||||
"status": "pending"
|
||||
}
|
||||
]
|
||||
}
|
||||
JSON
|
||||
- name: Plan Auditor validate
|
||||
run: python /tmp/plan-auditor/scripts/audit_check.py validate .
|
||||
- name: Plan Auditor execute and prove
|
||||
run: python /tmp/plan-auditor/scripts/audit_check.py run .
|
||||
- name: Plan Auditor full audit gate
|
||||
run: python /tmp/plan-auditor/scripts/audit_check.py audit .
|
||||
- name: Evidence summary
|
||||
if: always()
|
||||
run: |
|
||||
python /tmp/plan-auditor/scripts/audit_check.py status . || true
|
||||
echo '--- evidence tail ---'
|
||||
tail -n 20 .plan-auditor/evidence.jsonl 2>/dev/null || true
|
||||
- name: Run Plan Auditor validate, execute and full audit
|
||||
run: bash .github/issue-416-plan-auditor.sh
|
||||
- name: Upload audit evidence
|
||||
if: always()
|
||||
uses: actions/upload-artifact@v4
|
||||
|
||||
Loading…
Reference in New Issue
Block a user