f4b09b028e
cargo update -p rustls-webpki -p tar moves rustls-webpki 0.103.9 -> 0.103.13 and tar 0.4.44 -> 0.4.46, both within the existing Cargo.toml bounds. They sit under tauri-plugin-updater, which downloads and unpacks application updates, so all six of their advisories were reachable in the shipped binary. The remaining three can neither be fixed nor reached. quick-xml (2x 7.5 high) is pulled by plist, which tauri only needs for Apple bundling: its per-target trees are empty for both shipped targets and it appears solely under x86_64-apple-darwin. Its fix is >= 0.41.0 while plist requires ^0.38, a semver-incompatible boundary [patch.crates-io] cannot cross. rsa has no published fix at all and is never compiled — its only parent is sqlx-mysql, an artifact of sqlx's multi-backend graph on a SQLite project. Leaving those three to red the daily gate forever would reproduce the signal loss that #232 removed the `|| true` to fix, so they move into a versioned .cargo/audit.toml. Entries are keyed by advisory ID, never by crate, so a new advisory against the same crate still reds the gate; each carries its reachability proof and its removal condition. A blocking step in check-rust.yml re-proves that justification on every PR touching src-tauri/ or .cargo/, and fails if a suppressed crate enters a shipped target's graph — the scenario that would rot the list is itself a src-tauri change. It separates cargo tree's exit status from its output (an absent crate and a failed invocation both print nothing) and asserts a canary crate is still found, so its silence proves something. cargo audit: 9 vulnerabilities -> 0, warnings unchanged at 23 (cargo-audit 0.22.2, advisory-db 0bfde9d6 of 2026-07-27). cargo check + cargo test green (106 tests); npm build + 871 vitest green. Resolves #310 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
65 lines
1.8 KiB
YAML
65 lines
1.8 KiB
YAML
name: PR Check — Frontend
|
|
|
|
# Frontend half of the former check.yml (split in #232).
|
|
#
|
|
# Filtered with paths-ignore rather than an allowlist: this job costs ~2.5 min,
|
|
# so running it when it was not strictly needed is cheap, while silently NOT
|
|
# running it is not. A root-level config file added later would drop out of an
|
|
# allowlist without anyone noticing; here it fails safe.
|
|
#
|
|
# No `branches:` filter — see check-rust.yml.
|
|
|
|
on:
|
|
pull_request:
|
|
paths-ignore:
|
|
- 'src-tauri/**'
|
|
- '.cargo/**'
|
|
- 'docs/**'
|
|
- 'reports/**'
|
|
- 'tasks/**'
|
|
- '.github/**'
|
|
- '.claude/**'
|
|
- '.forgejo/workflows/check-rust.yml'
|
|
- '.forgejo/workflows/audit.yml'
|
|
- '.forgejo/workflows/release.yml'
|
|
- '*.md'
|
|
- 'LICENSE'
|
|
|
|
# Distinct group from the rust workflow — see check-rust.yml.
|
|
concurrency:
|
|
group: ci-frontend-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
frontend:
|
|
runs-on: ubuntu
|
|
container: ubuntu:22.04
|
|
steps:
|
|
- name: Install Node.js 20
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends curl ca-certificates git
|
|
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
|
|
apt-get install -y nodejs
|
|
node --version
|
|
npm --version
|
|
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
# No npm cache step here, deliberately — same reason as the cargo caches
|
|
# in check-rust.yml: the restore misses and the save times out against
|
|
# the runner's cache server (#234), which cost ~23s per run for nothing.
|
|
# Restore it together with rust-cache once #234 is fixed.
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Build (tsc + vite)
|
|
run: npm run build
|
|
|
|
- name: Tests (vitest)
|
|
run: npm test
|