Haozhe Wu
1e5b79dac6
React Router 7.12.0 through 8.2.x carry a high-severity RSC-mode CSRF bypass (GHSA-qwww-vcr4-c8h2). We were on 7.18.1, inside that range. The advisory is not reachable here — the app is a client-side SPA on createBrowserRouter with no @react-router/server and no RSC entry point, and the frontend ships as static Vite output — but 7.18.1 is the final 7.x release, no backport exists, and 8.3.0 is the only patched version, so staying put means staying on an EOL line with a permanent open alert. react-router-dom has no 8.x at all; the DOM exports moved into react-router itself. So the dependency is swapped and every import rewritten. All ten APIs in use here are unchanged in 8.3.0, and none of the data-layer surface that changed most between majors is used. react-router 8 requires Node >=22.22.0, which is the same wall that had jsdom 30 and @testing-library/jest-dom 7 sitting in the Dependabot ignore list. Node 20 reached EOL on 2026-04-30, so the toolchain moves to Node 22 across CI, the wiki workflow, the Dockerfile and docker-compose. That unblocks all three at once: jsdom and jest-dom are taken here too, and their ignores are removed rather than left carrying a rationale that no longer holds. Verified on the frontend suite: tsc -b and vite build clean, 310 tests across 35 files pass before and after the jsdom/jest-dom bumps.
109 lines
3.1 KiB
YAML
109 lines
3.1 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
|
with:
|
|
python-version: "3.11"
|
|
cache: pip
|
|
|
|
- name: Verify hash-locked dependencies
|
|
run: >-
|
|
pip install
|
|
--dry-run
|
|
--ignore-installed
|
|
--require-hashes
|
|
-r requirements-lock.txt
|
|
|
|
- name: Install dependencies
|
|
run: pip install -e ".[dev]"
|
|
|
|
- name: Repository safety gates
|
|
run: bash tools/ci_grep_gates.sh
|
|
|
|
- name: Test environment variable gate
|
|
run: pytest tools/test_ci_env_var_gate.py -q
|
|
|
|
- name: Syntax check
|
|
run: |
|
|
cd agent
|
|
python -m compileall -q cli
|
|
python -m py_compile api_server.py
|
|
python -m py_compile mcp_server.py
|
|
python -m py_compile src/agent/loop.py
|
|
python -m py_compile src/tools/__init__.py
|
|
python -m py_compile backtest/runner.py
|
|
|
|
- name: Run tests
|
|
# test_e2e_harness_v2.py is gated by VIBE_TRADING_RUN_LIVE_E2E
|
|
# (real-LLM only); list --ignore here so CI's intent is explicit and
|
|
# the suite never silently switches state on env presence.
|
|
run: pytest --ignore=agent/tests/e2e_backtest --ignore=agent/tests/test_e2e_harness_v2.py --cov=agent --cov-report=term-missing --cov-report=xml --tb=short -q
|
|
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: "22"
|
|
cache: npm
|
|
cache-dependency-path: frontend/package-lock.json
|
|
|
|
- name: Frontend build
|
|
run: |
|
|
cd frontend
|
|
npm ci
|
|
npm run build
|
|
|
|
- name: Frontend tests
|
|
run: |
|
|
cd frontend
|
|
npx vitest run --reporter=verbose
|
|
|
|
windows-background:
|
|
name: ${{ matrix.name }} / Python 3.14 background lifecycle
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 10
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- name: Windows 11 ARM64
|
|
runner: windows-11-arm
|
|
architecture: arm64
|
|
- name: Windows Server 2025 x64
|
|
runner: windows-2025
|
|
architecture: x64
|
|
|
|
steps:
|
|
# actions/checkout v7.0.1
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
|
|
|
# actions/setup-python v7.0.0
|
|
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
|
|
with:
|
|
python-version: "3.14"
|
|
architecture: ${{ matrix.architecture }}
|
|
cache: pip
|
|
|
|
- name: Install focused test dependencies
|
|
run: python -m pip install pytest pydantic pyyaml python-dotenv
|
|
|
|
- name: Run Windows background safety regressions
|
|
env:
|
|
PYTHONPATH: agent
|
|
run: >-
|
|
python -m pytest
|
|
agent/tests/test_background_tools.py
|
|
agent/tests/test_bash_tool.py
|
|
-q
|