09186e23b9
Some checks failed
Backend Tests / pytest (Python 3.12) (push) Has been cancelled
Deploy to Production / backend-tests (push) Has been cancelled
Deploy to Production / frontend-build (push) Has been cancelled
Frontend Checks / Build & typecheck (push) Has been cancelled
SonarCloud / SonarCloud Analysis (push) Has been cancelled
Deploy to Production / Trigger production update (push) Has been cancelled
Security - Enforce guest ownership and server assignment across Proxmox endpoints (VM/LXC actions, firewall, backups, tasks, bulk operations, deploy, LXC/ISO creation, golden template) and WebSocket channels - Keep the panel's PVE root ticket server-side for consoles; single-use WebSocket tickets instead of the JWT in URLs; re-check access on open WebSocket bridges - Validate identifiers that reach Proxmox API paths and node shell commands; reject backup archives / foreign volumes in create requests - Close privilege escalation in user management, TOTP replay, reset-link poisoning, X-Forwarded-For spoofing, stored XSS (group icons, SVG logos) - SSH host key pinning (TOFU), encrypted 2FA seeds and notification secrets, password changes end other sessions, redact secrets in logs - Quotas count in-flight creations; 2FA failures count toward lockout Fixes - Consoles on non-default API ports, large App Store/script files, interrupted tasks after restart, impersonation lost on token refresh, HTTPExceptions swallowed into 500s, WebSocket client reconnects Performance and process - Fewer DB writes and queries on hot paths, lazy-loaded locales and heavy pages, off-loop blocking work, indexes (migrations 44-46) - Deploy waits for backend tests and frontend build; frontend checks workflow; API bound to loopback without the SSL profile
61 lines
1.5 KiB
YAML
61 lines
1.5 KiB
YAML
name: Backend Tests
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "backend/**"
|
|
- ".github/workflows/backend-tests.yml"
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- "backend/**"
|
|
- ".github/workflows/backend-tests.yml"
|
|
# Reused by deploy.yml so production is only updated from a green build.
|
|
workflow_call:
|
|
|
|
jobs:
|
|
pytest:
|
|
name: pytest (Python ${{ matrix.python-version }})
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
python-version: ["3.12"]
|
|
|
|
defaults:
|
|
run:
|
|
working-directory: backend
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Python ${{ matrix.python-version }}
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: ${{ matrix.python-version }}
|
|
cache: pip
|
|
cache-dependency-path: backend/requirements-dev.txt
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
pip install -r requirements-dev.txt
|
|
|
|
- name: Run pytest with coverage
|
|
run: |
|
|
python -m pytest \
|
|
--cov=app \
|
|
--cov-report=term-missing \
|
|
--cov-report=xml \
|
|
-p no:warnings
|
|
|
|
- name: Upload coverage artifact
|
|
if: always()
|
|
# v3 of the artifact actions was shut down by GitHub (jobs using it fail).
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: backend-coverage-${{ matrix.python-version }}
|
|
path: backend/coverage.xml
|
|
if-no-files-found: ignore
|