09186e23b9
Some checks failed
Backend Tests / pytest (Python 3.12) (push) Has been cancelled
Deploy to Production / backend-tests (push) Has been cancelled
Deploy to Production / frontend-build (push) Has been cancelled
Frontend Checks / Build & typecheck (push) Has been cancelled
SonarCloud / SonarCloud Analysis (push) Has been cancelled
Deploy to Production / Trigger production update (push) Has been cancelled
Security - Enforce guest ownership and server assignment across Proxmox endpoints (VM/LXC actions, firewall, backups, tasks, bulk operations, deploy, LXC/ISO creation, golden template) and WebSocket channels - Keep the panel's PVE root ticket server-side for consoles; single-use WebSocket tickets instead of the JWT in URLs; re-check access on open WebSocket bridges - Validate identifiers that reach Proxmox API paths and node shell commands; reject backup archives / foreign volumes in create requests - Close privilege escalation in user management, TOTP replay, reset-link poisoning, X-Forwarded-For spoofing, stored XSS (group icons, SVG logos) - SSH host key pinning (TOFU), encrypted 2FA seeds and notification secrets, password changes end other sessions, redact secrets in logs - Quotas count in-flight creations; 2FA failures count toward lockout Fixes - Consoles on non-default API ports, large App Store/script files, interrupted tasks after restart, impersonation lost on token refresh, HTTPExceptions swallowed into 500s, WebSocket client reconnects Performance and process - Fewer DB writes and queries on hot paths, lazy-loaded locales and heavy pages, off-loop blocking work, indexes (migrations 44-46) - Deploy waits for backend tests and frontend build; frontend checks workflow; API bound to loopback without the SSL profile
63 lines
1.9 KiB
YAML
63 lines
1.9 KiB
YAML
name: Frontend Checks
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "frontend/**"
|
|
- ".github/workflows/frontend-checks.yml"
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- "frontend/**"
|
|
- ".github/workflows/frontend-checks.yml"
|
|
workflow_call:
|
|
|
|
jobs:
|
|
build:
|
|
name: Build & typecheck
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: frontend
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
cache: npm
|
|
cache-dependency-path: frontend/package-lock.json
|
|
|
|
# npm install (not ci), same as the Dockerfile: the lockfile is produced on
|
|
# Windows and lacks some Linux-only optional deps, which makes `npm ci` fail.
|
|
- name: Install dependencies
|
|
run: npm install --no-audit --no-fund
|
|
|
|
# Russian sessions do not load en.json as a fallback (lib/i18n.ts), so a
|
|
# key present only in en.json would show up raw in the Russian UI.
|
|
- name: Locale keys parity (ru covers en)
|
|
run: |
|
|
node -e '
|
|
const flat = (o, p = "") => Object.entries(o).flatMap(([k, v]) =>
|
|
v && typeof v === "object" ? flat(v, p + k + ".") : [p + k]);
|
|
const ru = new Set(flat(require("./src/locales/ru.json")));
|
|
const missing = flat(require("./src/locales/en.json")).filter((k) => !ru.has(k));
|
|
if (missing.length) { console.error("Missing in ru.json:\n" + missing.join("\n")); process.exit(1); }
|
|
'
|
|
|
|
# The production image only runs `vite build`, so this is the gate that
|
|
# must stay green.
|
|
- name: Production build
|
|
run: npm run build
|
|
|
|
# Reported, not yet enforced: flip to blocking once the existing
|
|
# type and lint findings are cleared.
|
|
- name: Typecheck
|
|
run: npx tsc -b
|
|
continue-on-error: true
|
|
|
|
- name: Lint
|
|
run: npm run lint
|
|
continue-on-error: true
|