feat: Milestone 4 - Voting & Final Publish Flow #162
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| name: db-tests | ||
| on: | ||
| # Manual trigger remains available | ||
| workflow_dispatch: | ||
| # Run weekly for drift detection | ||
| schedule: | ||
| - cron: '0 6 * * 1' # weekly Monday 06:00 UTC | ||
| # Run automatically on PRs when DB‑related files change | ||
| pull_request: | ||
| paths: | ||
| - 'db/**' | ||
| - 'server/rpc.js' | ||
| - 'server/journal.js' | ||
| - 'server/watcher.js' | ||
| - 'server/schemas.js' | ||
| - 'bin/db8.js' | ||
| - 'server/test/**' | ||
| types: [opened, synchronize, reopened] | ||
| jobs: | ||
| db-integration: | ||
| # Avoid duplicate concurrent runs for the same PR/branch | ||
| concurrency: | ||
| group: db-tests-${{ github.event.pull_request.number || github.ref }} | ||
| cancel-in-progress: true | ||
| runs-on: ubuntu-latest | ||
| services: | ||
| postgres: | ||
| image: postgres:16 | ||
| ports: ['5432:5432'] | ||
| env: | ||
| POSTGRES_PASSWORD: test | ||
| POSTGRES_USER: postgres | ||
| POSTGRES_DB: postgres | ||
| # NOTE: Do not include shell line-continuation backslashes here; the | ||
| # options string is passed directly to `docker create`. | ||
| options: >- | ||
| --health-cmd="pg_isready -U postgres" | ||
| --health-interval=10s | ||
| --health-timeout=5s | ||
| --health-retries=5 | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: '20' | ||
| - run: npm ci | ||
| - name: Install web dependencies | ||
| run: npm ci --prefix web | ||
| - name: Create test database | ||
| env: | ||
| PGPASSWORD: test | ||
| run: | | ||
| until pg_isready -h localhost -p 5432 -U postgres; do sleep 2; done | ||
| psql -h localhost -U postgres -c 'CREATE DATABASE db8_test;' | ||
| - name: Prepare schema/RPC/RLS | ||
| env: | ||
| DATABASE_URL: postgresql://postgres:test@localhost:5432/db8_test | ||
| DB8_TEST_OUTPUT: quiet | ||
| run: node scripts/prepare-db.js | ||
| - name: Run lint (server/db only) | ||
| run: | | ||
| # Limit lint to non-web paths for this DB-focused job to avoid resolver noise | ||
| npx eslint server bin scripts eslint.config.js vitest.config.js | ||
| - name: Run DB-gated tests (glob) | ||
| env: | ||
| DB8_TEST_PG: '1' | ||
| DB8_TEST_DATABASE_URL: postgresql://postgres:test@localhost:5432/db8_test | ||
| run: | | ||
| npx vitest run "server/test/**/*.db.*.js" server/test/journal.byidx.test.js --reporter verbose | ||
|
Comment on lines
+64
to
+69
There was a problem hiding this comment. 🛠️ Refactor suggestion | 🟠 Major 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Verify glob pattern matching and check additional file
echo "=== Files matching *.db.*.js pattern in server/test/ ==="
fd -e js -t f "\.db\..*\.js$" server/test/ 2>/dev/null || echo "No matches found"
echo ""
echo "=== Checking for journal.byidx.test.js ==="
if [ -f "server/test/journal.byidx.test.js" ]; then
echo "Found: server/test/journal.byidx.test.js"
head -5 server/test/journal.byidx.test.js
else
echo "NOT FOUND: server/test/journal.byidx.test.js"
fi
echo ""
echo "=== All .test.js files in server/test/ (first 20) ==="
fd -e js -t f "\.test\.js$" server/test/ | head -20
echo ""
echo "=== Check if any other DB-related test files exist ==="
fd -e js -t f "db" server/test/ | head -20Repository: flyingrobots/db8 Length of output: 1593 Naming convention inconsistency: The glob pattern 🤖 Prompt for AI Agents |
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Bypass vulnerability: Text-based merge detection is trivially circumventable and incomplete.
This implementation has critical flaws:
Security bypass: Any developer can write a manual commit message starting with "Merge branch" to skip Conventional Commits validation entirely. If this hook exists to enforce policy, it's now opt-in.
Incomplete pattern: The regex misses legitimate Git-generated merge messages:
Merge tag 'v1.0'Merge commit 'abc123'Design flaw acknowledged in comments: Line 7's comment admits "checking the message content rather than repository state"—but that's precisely the vulnerability. Merge commits have multiple parents; checking repository state is the correct, unforgeable approach.
🔎 Proposed fix: Check actual merge state, not message text
This checks if the current commit actually has multiple parents (true merge) rather than trusting user-supplied text. Note: This won't work for the initial merge commit before it exists; you may need to check
git rev-parse --verify MERGE_HEADas a fallback during merge-in-progress state.🤖 Prompt for AI Agents