mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
d1730f5b8a
dast-smoke.yml and 3 nightly API-only smoke workflows (nightly-schemathesis, nightly-resilience, nightly-llm-security) ran "npm run build:cli" with no preceding full build or downloaded .build/next artifact. scripts/build/ prepublish.ts silently falls back to a full Next.js production build (dashboard UI + ~126 leaf pages + prerender) whenever the standalone server.js is missing, which is always the case in these jobs. That inline full build is the actual thing varying 6-29min on GitHub-hosted runners. These workflows only exercise API routes (schemathesis/promptfoo hit /api/monitoring/health, /v1/chat/completions, /v1/models, /api/auth, /api/keys) and never touch the dashboard UI, so set OMNIROUTE_BUILD_BACKEND_ONLY=1 on their "Build CLI bundle" step — an existing, previously-unused escape hatch (scripts/build/backendOnlyPages.mjs) that stubs the dashboard pages before the build and restores them after, leaving every route.ts API handler intact. npm-publish.yml is intentionally left untouched: it legitimately ships the full dashboard UI in the published npm package. Regression guard: tests/unit/build/backend-only-smoke-workflows.test.ts asserts OMNIROUTE_BUILD_BACKEND_ONLY=1/OMNIROUTE_BUILD_PROFILE=backend on all 5 "Build CLI bundle" steps across the 4 fixed workflows, and asserts npm-publish.yml's build step is NOT backend-only.
68 lines
2.6 KiB
YAML
68 lines
2.6 KiB
YAML
name: DAST smoke (PR)
|
|
on:
|
|
pull_request:
|
|
branches: ["main", "release/**"]
|
|
permissions:
|
|
contents: read
|
|
jobs:
|
|
dast-smoke:
|
|
runs-on: ubuntu-latest
|
|
# ADVISORY while this new gate matures (repo convention: advisory -> blocking).
|
|
# Flip to blocking (remove continue-on-error) once it's proven stable across a few PRs.
|
|
continue-on-error: true
|
|
# Build CLI bundle alone varies 6-11min on GitHub-hosted runners (3 consecutive
|
|
# timeouts observed on 2026-07-14 with the old 12min cap killing schemathesis
|
|
# mid-run) — 25min leaves real headroom for the actual DAST steps.
|
|
timeout-minutes: 25
|
|
env:
|
|
JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
|
|
API_KEY_SECRET: ci-api-key-secret-with-sufficient-length-aaaa
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: "24"
|
|
cache: npm
|
|
- run: npm ci
|
|
- name: Build CLI bundle
|
|
env:
|
|
OMNIROUTE_BUILD_BACKEND_ONLY: "1"
|
|
run: npm run build:cli
|
|
- name: Start OmniRoute
|
|
env:
|
|
PORT: "20128"
|
|
INJECTION_GUARD_MODE: block
|
|
run: |
|
|
node dist/server.js > server.log 2>&1 &
|
|
echo $! > server.pid
|
|
for _ in $(seq 1 30); do
|
|
if curl -sf http://localhost:20128/api/monitoring/health >/dev/null; then echo up; break; fi
|
|
sleep 2
|
|
done
|
|
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
|
with:
|
|
python-version: "3.12"
|
|
- run: pip install schemathesis
|
|
- name: Schemathesis smoke (high-risk endpoints, blocking)
|
|
run: |
|
|
schemathesis run docs/openapi.yaml --url http://localhost:20128 \
|
|
--include-path-regex '^/v1/(chat/completions|models)$|^/api/(auth|keys)' \
|
|
--max-examples 8 --workers 4 --checks all --max-response-time 30 \
|
|
--request-timeout 20 --suppress-health-check all --no-color
|
|
- name: promptfoo injection-guard (blocking)
|
|
env:
|
|
OMNIROUTE_URL: http://localhost:20128
|
|
OMNIROUTE_API_KEY: not-needed-blocked-before-upstream
|
|
run: npx --yes promptfoo@latest eval -c promptfooconfig.yaml --no-cache
|
|
- name: Stop server
|
|
if: always()
|
|
run: kill "$(cat server.pid)" || true
|
|
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
if: always()
|
|
with:
|
|
name: dast-smoke-logs
|
|
path: server.log
|
|
retention-days: 7
|