Lucas Winther
6eb77c8733
One build artifact serves both a self-hosted subpath deploy and GitHub Pages. CI runs the tests, typechecks, builds, and smoke-tests the image. server.ts's traversal guard uses a separator-aware check (resolved === root || resolved.startsWith(root + path.sep)) instead of a bare startsWith(root), which would let a request resolving to "/app/dist-evil/x" pass a check against root "/app/dist".
37 lines
975 B
YAML
37 lines
975 B
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: latest
|
|
- run: bun install --frozen-lockfile
|
|
- run: bun test
|
|
- run: bunx tsc --noEmit
|
|
- run: bun run build
|
|
|
|
docker:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- run: docker build -t budget2 .
|
|
- name: Serve the image and check it responds
|
|
run: |
|
|
docker run -d --rm -p 3000:3000 --name budget2 budget2
|
|
for i in $(seq 1 30); do
|
|
if curl -fsS http://localhost:3000/ > /dev/null; then break; fi
|
|
sleep 1
|
|
done
|
|
curl -fsS http://localhost:3000/ | grep -q "Budget"
|
|
curl -fsS http://localhost:3000/sw.js > /dev/null
|
|
curl -fsS http://localhost:3000/manifest.webmanifest > /dev/null
|
|
docker stop budget2
|