forked from mirror/crumbs-original
Claude
effe7e3e72
The image switched to the node user (uid 1000) at build time, so a host folder mounted at /data kept its host ownership and SQLite failed with SQLITE_CANTOPEN in a restart loop. Named and anonymous volumes worked only because Docker copies the image's /data ownership into them. The container now starts as root, hands DATA_DIR and the database folder to node (only entries not already owned by it), and execs the app via setpriv as node. Containers started with an explicit `user:` skip this. Adds a CI step that runs the image with a host-owned bind mount. Fixes #93 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016MHECwBhBpM248EFSBi4L5
146 lines
3.5 KiB
YAML
146 lines
3.5 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
workflow_call:
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
lint-and-check:
|
|
name: Lint & Type Check
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
- run: pnpm check
|
|
|
|
unit-tests:
|
|
name: Unit Tests
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
- run: pnpm test:unit:coverage
|
|
|
|
- name: Coverage summary
|
|
if: always()
|
|
run: bash scripts/coverage-summary.sh "Unit Test Coverage" coverage/unit/coverage-summary.json
|
|
|
|
- uses: actions/upload-artifact@v4
|
|
if: always()
|
|
with:
|
|
name: unit-coverage
|
|
path: coverage/unit/
|
|
retention-days: 14
|
|
|
|
e2e-tests:
|
|
name: E2E Tests
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: mcr.microsoft.com/playwright:v1.62.1-noble
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- name: Build (with coverage instrumentation)
|
|
run: pnpm build
|
|
env:
|
|
DATABASE_URL: ./data/test-crumbs.db
|
|
NODE_ENV: test
|
|
VITE_COVERAGE: 'true'
|
|
|
|
- run: pnpm test:e2e
|
|
env:
|
|
CI: true
|
|
VITE_COVERAGE: 'true'
|
|
HOME: /root
|
|
|
|
- name: Merge E2E coverage
|
|
if: always()
|
|
run: npx nyc report
|
|
|
|
- name: Coverage summary
|
|
if: always()
|
|
run: bash scripts/coverage-summary.sh "E2E Test Coverage" coverage/e2e/coverage-summary.json
|
|
|
|
- uses: actions/upload-artifact@v4
|
|
if: always()
|
|
with:
|
|
name: playwright-report
|
|
path: |
|
|
playwright-report/
|
|
test-results/
|
|
retention-days: 7
|
|
|
|
- uses: actions/upload-artifact@v4
|
|
if: always()
|
|
with:
|
|
name: e2e-coverage
|
|
path: coverage/e2e/
|
|
retention-days: 14
|
|
|
|
docker-build:
|
|
name: Docker Build
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build Docker image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
push: false
|
|
provenance: false
|
|
tags: crumbs:ci
|
|
load: true
|
|
cache-from: type=gha,scope=ci-docker
|
|
cache-to: type=gha,scope=ci-docker,mode=max
|
|
|
|
# Regression for #93: a host folder bind-mounted at /data is owned by the
|
|
# host user (the runner, uid 1001), not the container's node user (1000)
|
|
- name: Start with a host-owned bind mount
|
|
run: |
|
|
mkdir -p "$RUNNER_TEMP/crumbs-data"
|
|
docker run -d --name crumbs -p 3000:3000 -v "$RUNNER_TEMP/crumbs-data:/data" crumbs:ci
|
|
for i in $(seq 1 30); do
|
|
if curl -fsS -o /dev/null http://localhost:3000/login; then
|
|
test -f "$RUNNER_TEMP/crumbs-data/crumbs.db" && exit 0
|
|
fi
|
|
sleep 1
|
|
done
|
|
docker logs crumbs
|
|
exit 1
|