From 9d9725dee060d1824fae6f94bb3d550e129f25d9 Mon Sep 17 00:00:00 2001 From: Furox Date: Sat, 5 Sep 2026 01:47:10 +0300 Subject: [PATCH] chore: simplify issue 416 plan-auditor workflow --- .github/workflows/issue-416-plan-auditor.yml | 153 +------------------ 1 file changed, 5 insertions(+), 148 deletions(-) diff --git a/.github/workflows/issue-416-plan-auditor.yml b/.github/workflows/issue-416-plan-auditor.yml index 4271f8f54..4d6cafde0 100644 --- a/.github/workflows/issue-416-plan-auditor.yml +++ b/.github/workflows/issue-416-plan-auditor.yml @@ -2,9 +2,10 @@ name: Issue 416 Plan Auditor on: push: - branches: ["feat/issue-416-backup-destinations"] + branches: + - feat/issue-416-backup-destinations paths: - - ".github/workflows/issue-416-plan-auditor.yml" + - .github/workflows/issue-416-plan-auditor.yml permissions: contents: read @@ -24,152 +25,8 @@ jobs: node-version: 24.4.0 cache: pnpm - run: pnpm install --frozen-lockfile - - name: Load Plan Auditor skill - run: | - git clone --depth 1 https://github.com/Furox-Art/plan-auditor.git /tmp/plan-auditor - echo "Plan Auditor commit: $(git -C /tmp/plan-auditor rev-parse HEAD)" - grep -F 'version: "1.1.0"' /tmp/plan-auditor/SKILL.md - - name: Create locked audit plan - run: | - mkdir -p .plan-auditor - cat > .plan-auditor/plan.json <<'JSON' - { - "task": "Issue #416 / PR #5349 final root-cause, security, regression and acceptance audit", - "created": "2026-09-05T01:45:00+03:00", - "steps": [ - { - "id": 1, - "title": "Provider acceptance and S3 compatibility", - "verify": [ - { - "type": "run", - "cmd": "pnpm --filter=dokploy exec vitest --config __test__/vitest.config.ts __test__/utils/backups.test.ts --run", - "expect_exit": 0, - "timeout": 300 - }, - { - "type": "regex", - "path": "packages/server/src/db/validations/destination.ts", - "pattern": "GOOGLE_DRIVE[\\s\\S]*ONEDRIVE[\\s\\S]*FTP[\\s\\S]*SFTP" - }, - { - "type": "regex", - "path": "packages/server/src/utils/backups/utils.ts", - "pattern": "getRclonePathAndFlags" - } - ], - "status": "pending" - }, - { - "id": 2, - "title": "Security invariants and bypass resistance", - "verify": [ - { - "type": "run", - "cmd": "pnpm --filter=dokploy exec vitest --config __test__/vitest.config.ts __test__/backups/redact-credentials.test.ts __test__/utils/issue-416-path-safety.test.ts --run", - "expect_exit": 0, - "timeout": 300 - }, - { - "type": "regex", - "path": "packages/server/src/utils/backups/utils.ts", - "pattern": "assertSafeRclonePath" - }, - { - "type": "regex", - "path": "packages/server/src/db/validations/destination.ts", - "pattern": "matchingFlags\\.length !== 1" - }, - { - "type": "regex", - "path": "packages/server/src/utils/backups/redact.ts", - "pattern": "sftp-key-file-pass" - } - ], - "status": "pending" - }, - { - "id": 3, - "title": "Execution-environment parity for local and remote servers", - "verify": [ - { - "type": "run", - "cmd": "pnpm typecheck", - "expect_exit": 0, - "timeout": 300 - }, - { - "type": "run", - "cmd": "python - <<'PY'\nfrom pathlib import Path\nr=Path('apps/dokploy/server/api/routers/destination.ts').read_text()\nu=Path('apps/dokploy/components/dashboard/settings/destination/handle-destinations.tsx').read_text()\nassert 'if (IS_CLOUD && !input.serverId)' in r\nassert 'if (input.serverId)' in r\nassert 'findServerById(input.serverId)' in r\nassert 'server.organizationId !== ctx.session.activeOrganizationId' in r\nassert 'execAsyncRemote(input.serverId, rcloneCommand)' in r\nassert 'showServerSelector = Boolean(isCloud) || hasRemoteServers' in u\nassert 'Dokploy Server (Local)' in u\nprint('local/remote destination test routing invariants verified')\nPY", - "expect_exit": 0 - }, - { - "type": "regex", - "path": "apps/dokploy/server/api/routers/destination.ts", - "pattern": "if \\(input\\.serverId\\)" - }, - { - "type": "regex", - "path": "apps/dokploy/components/dashboard/settings/destination/handle-destinations.tsx", - "pattern": "showServerSelector = Boolean\\(isCloud\\) \\|\\| hasRemoteServers" - } - ], - "status": "pending" - }, - { - "id": 4, - "title": "Build and formatting regression gate", - "verify": [ - { - "type": "run", - "cmd": "pnpm server:build", - "expect_exit": 0, - "timeout": 300 - }, - { - "type": "run", - "cmd": "pnpm exec biome check apps/dokploy/__test__/backups/redact-credentials.test.ts apps/dokploy/__test__/utils/backups.test.ts apps/dokploy/__test__/utils/issue-416-path-safety.test.ts apps/dokploy/components/dashboard/settings/destination/constants.ts apps/dokploy/components/dashboard/settings/destination/handle-destinations.tsx apps/dokploy/server/api/routers/backup.ts apps/dokploy/server/api/routers/destination.ts packages/server/src/db/schema/destination.ts packages/server/src/db/validations/destination.ts packages/server/src/utils/backups packages/server/src/utils/restore packages/server/src/utils/volume-backups", - "expect_exit": 0, - "timeout": 300 - } - ], - "status": "pending" - }, - { - "id": 5, - "title": "Full fix-issue regression suite with strict infrastructure-failure classification", - "verify": [ - { - "type": "run", - "cmd": "bash -lc 'set +e; pnpm test -- --run > /tmp/issue416-full-test.log 2>&1; rc=$?; cat /tmp/issue416-full-test.log; if [ $rc -eq 0 ]; then echo FULL_SUITE_ZERO_FAILURES; exit 0; fi; python - <<\"PY\"\nimport re, sys\nfrom pathlib import Path\ns=re.sub(r\"\\x1b\\[[0-9;]*m\", \"\", Path(\"/tmp/issue416-full-test.log\").read_text(errors=\"replace\"))\nrequired=[\"__test__/deploy/application.real.test.ts\",\"__test__/setup/monitoring-setup.real.test.ts\"]\nif not all(x in s for x in required):\n raise SystemExit(\"known Swarm integration files not both present in failure log\")\nif not re.search(r\"Test Files\\s+2 failed\", s):\n raise SystemExit(\"full suite has a failure-file count other than the two known Swarm files\")\nif not re.search(r\"Tests\\s+8 failed\\s+\\|\\s+990 passed\\s+\\|\\s+1 skipped\", s):\n raise SystemExit(\"full suite result changed from the known 8 Swarm failures / 990 pass / 1 skip baseline\")\nif \"swarm manager\" not in s.lower():\n raise SystemExit(\"known Docker Swarm manager environment signature missing\")\nprint(\"FULL_SUITE_ONLY_KNOWN_SWARM_ENV_FAILURES\")\nPY'", - "expect_exit": 0, - "output_regex": "FULL_SUITE_(ZERO_FAILURES|ONLY_KNOWN_SWARM_ENV_FAILURES)", - "timeout": 600 - }, - { - "type": "run", - "cmd": "pnpm --filter=dokploy exec vitest --config __test__/vitest.config.ts --run --exclude __test__/deploy/application.real.test.ts --exclude __test__/setup/monitoring-setup.real.test.ts", - "expect_exit": 0, - "timeout": 600 - } - ], - "status": "pending" - } - ] - } - JSON - - name: Plan Auditor validate - run: python /tmp/plan-auditor/scripts/audit_check.py validate . - - name: Plan Auditor execute and prove - run: python /tmp/plan-auditor/scripts/audit_check.py run . - - name: Plan Auditor full audit gate - run: python /tmp/plan-auditor/scripts/audit_check.py audit . - - name: Evidence summary - if: always() - run: | - python /tmp/plan-auditor/scripts/audit_check.py status . || true - echo '--- evidence tail ---' - tail -n 20 .plan-auditor/evidence.jsonl 2>/dev/null || true + - name: Run Plan Auditor validate, execute and full audit + run: bash .github/issue-416-plan-auditor.sh - name: Upload audit evidence if: always() uses: actions/upload-artifact@v4