The discussion on the gibbon PR (321) suggests the following: - this would only be a problem if you accepted an API key via user input - That's correct, I implemented what I believe is a complete fix in 3.4.4. This conflicts with the github advisory (and bundle audit). We do accept mailchimp api keys from user input (restricted to the admin area). It looks like the underlying conflict is around domain include?(api.mailchimp.com) permitting matches that aren't authoritative (for example, api.mailchimp.completelyhijacked.xyz would "include?" the right domain).
148 lines
5 KiB
YAML
148 lines
5 KiB
YAML
dist: focal
|
|
branches:
|
|
only:
|
|
- main
|
|
language: ruby
|
|
cache:
|
|
bundler: true
|
|
directories:
|
|
- node_modules
|
|
rvm:
|
|
- 3.0.2
|
|
addons:
|
|
postgresql: '13'
|
|
apt:
|
|
packages:
|
|
- postgresql-13
|
|
chrome: 'stable'
|
|
artifacts:
|
|
paths:
|
|
- $(ls tmp/screenshots/*.png | tr "\n" ":")
|
|
- $(ls tmp/csvs/*.csv | tr "\n" ":")
|
|
- $(ls cypress/screenshots/*.* | tr "\n" ":")
|
|
- $(ls cypress/videos/*.* | tr "\n" ":")
|
|
debug: true
|
|
env:
|
|
global:
|
|
- RAILS_ENV=test
|
|
- DATABASE_URL=postgres://travis@localhost:5432/Forem_prod_test
|
|
- DATABASE_NAME=Forem_prod_test
|
|
- DATABASE_URL_TEST=postgres://travis@localhost:5432/Forem_test
|
|
- DATABASE_NAME_TEST=Forem_test
|
|
# Dummy values needed to verify the app boots via "rails runner"
|
|
- APP_PROTOCOL=http://
|
|
- APP_DOMAIN=localhost:3000
|
|
- HEROKU_APP_URL=practicaldev.herokuapp.com
|
|
- SECRET_KEY_BASE=dummydummydummy
|
|
- GITHUB_KEY=dummy
|
|
- GITHUB_SECRET=dummy
|
|
- KNAPSACK_PRO_FIXED_QUEUE_SPLIT=true
|
|
- KNAPSACK_PRO_LOG_LEVEL=info
|
|
- KNAPSACK_PRO_CI_NODE_TOTAL=3
|
|
- COVERAGE_REPORTS_TOTAL=4
|
|
- FOREM_OWNER_SECRET="secret" # test secret so e2e tests can run properly.
|
|
before_install:
|
|
- sudo apt-get update
|
|
- sudo apt-get -y install gsfonts
|
|
- sudo sed -i -e '/local.*peer/s/postgres/all/' -e 's/peer\|md5/trust/g' /etc/postgresql/*/main/pg_hba.conf
|
|
- sudo service postgresql restart
|
|
- gem install bundler:"<2.3"
|
|
install:
|
|
- date --rfc-3339=seconds
|
|
- nvm install
|
|
- bundle config set path 'vendor/bundle'
|
|
- bin/ci-bundle
|
|
- yarn install --frozen-lockfile
|
|
script:
|
|
- bundle exec rails db:create db:schema:load webpacker:compile
|
|
- bin/knapsack_pro_rspec
|
|
notifications:
|
|
slack:
|
|
if: branch = main
|
|
on_pull_requests: false
|
|
on_success: change
|
|
on_failure: always
|
|
rooms:
|
|
secure: 0cTxjTqAFnfCR9jw7lZFcTrTcil8QKTX4h2dzKKCeWaWpsYcvJsvhREfsdIGwrdChmHHYCveHp84dP3ouMvcXoSYEzTASZpK+nVGw2+E4kh3EbzA49N00RoeM+gnbEla3MtCjVxH7KVznLyV/jVfFoCZR6xYnO+pknZzUZwJzyffnSmAlwsQkw1Dt1FAw/uodfGqiDJjUgZhtQ51KFg74HiBd80iUc8ieg6zAEV4QnlW3YvjrHSJC2+AFblXQ7RVkAok8w3G876yQOXvEfESCV+wlmoXbSlQm7V2awMmY5v23iKMvJRRn7JMxTGzG1x2NvNIFL8NZBM+CcjMJxkDSU7Rc/hxVAbuEEYQdd3VPKmYv3o5jcPYjQY08nbz4OREZtiXMsFVCOLuZaCba2c7Xelr7c0eFOdRpQScN2SQtI039Zw8jUQgni18kiWyD/1CfYFIGUvpTCy8rHN0RCJkb0+wOlo3UjEbVDqCi6x06yQ/367XHc27hzFpfDQprVccCMDHbE47kj2fUsBX+FaocpzwODBMLLXZf/v6Vg/bhVArxAl9GLmWNt8942YVgRzkboR3yAy1mA3wx/1frLURY1C5377dx7LXwhHp/4Od6ms1xTBSEcEIRWPy7wQ0yG8fe9VPNFc0ndCEPnqkF8NLTxOX9w3uQ3wDB78NEyEDni0=
|
|
|
|
|
|
jobs:
|
|
include:
|
|
- stage: Test
|
|
name: "Node 0"
|
|
env: KNAPSACK_PRO_CI_NODE_INDEX=0
|
|
- stage: Test
|
|
name: "Node 1"
|
|
env: KNAPSACK_PRO_CI_NODE_INDEX=1
|
|
- stage: Test
|
|
name: "Node 2"
|
|
env: KNAPSACK_PRO_CI_NODE_INDEX=2
|
|
- stage: Test
|
|
name: "Front-end tests, Storybook, bundle audit, console check"
|
|
script:
|
|
- yarn lint:frontend
|
|
- yarn test --colors
|
|
- bundle exec bundle-audit check --update --ignore=CVE-2022-27311
|
|
- bin/test-console-check
|
|
- yarn build-storybook
|
|
- NODE_ENV=production RAILS_ENV=production bundle exec rake assets:precompile
|
|
- stage: Test
|
|
name: "E2E Seeded Node 0"
|
|
env:
|
|
- KNAPSACK_PRO_CI_NODE_TOTAL=3
|
|
- KNAPSACK_PRO_CI_NODE_INDEX=0
|
|
- KNAPSACK_PRO_TEST_FILE_PATTERN="cypress/integration/seededFlows/**/*.spec.js"
|
|
script:
|
|
- bundle exec rails db:create db:schema:load assets:precompile
|
|
- yarn cypress install
|
|
- bin/knapsack_pro_cypress
|
|
- stage: Test
|
|
name: "E2E Seeded Node 1"
|
|
env:
|
|
- KNAPSACK_PRO_CI_NODE_TOTAL=3
|
|
- KNAPSACK_PRO_CI_NODE_INDEX=1
|
|
- KNAPSACK_PRO_TEST_FILE_PATTERN="cypress/integration/seededFlows/**/*.spec.js"
|
|
script:
|
|
- bundle exec rails db:create db:schema:load assets:precompile
|
|
- yarn cypress install
|
|
- bin/knapsack_pro_cypress
|
|
- stage: Test
|
|
name: "E2E Seeded Node 2"
|
|
env:
|
|
- KNAPSACK_PRO_CI_NODE_TOTAL=3
|
|
- KNAPSACK_PRO_CI_NODE_INDEX=2
|
|
- KNAPSACK_PRO_TEST_FILE_PATTERN="cypress/integration/seededFlows/**/*.spec.js"
|
|
script:
|
|
- bundle exec rails db:create db:schema:load assets:precompile
|
|
- yarn cypress install
|
|
- bin/knapsack_pro_cypress
|
|
- stage: Test
|
|
name: "E2E Non-seeded"
|
|
script:
|
|
- bundle exec rails db:create db:schema:load assets:precompile
|
|
- yarn cypress install
|
|
- CREATOR_ONBOARDING_SEED_DATA=1 E2E_FOLDER=creatorOnboardingFlows E2E=true bin/rails cypress:run
|
|
- stage: Deploy
|
|
name: Deploy DEV
|
|
if: type != pull_request
|
|
install: skip
|
|
script: skip
|
|
after_script: skip
|
|
deploy:
|
|
provider: heroku
|
|
api_key: '$HEROKU_AUTH_TOKEN'
|
|
app:
|
|
main: practicaldev
|
|
after_deploy:
|
|
- bash scripts/after_deploy.sh
|
|
- stage: Deploy
|
|
name: Deploy BenHalpern
|
|
if: type != pull_request
|
|
install: skip
|
|
script: skip
|
|
after_script: skip
|
|
deploy:
|
|
provider: heroku
|
|
api_key: '$HEROKU_AUTH_TOKEN'
|
|
app:
|
|
main: benhalpern-community
|