mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtterandGitHub
d10d0f544f
A release-readiness QA pass over the whole product. The commits split into defects a user would hit and gates that were reporting green while measuring nothing. ## Fixes that change behaviour Rate limiting was bypassable on every install: TRUST_PROXY defaulted to true, so request.ip came from a client-set header and a forged X-Forwarded-For got past the login limiter. The default is now a private-network trust list. A transient Postgres outage stranded in-flight jobs, leaving finished output on disk with no row pointing at it. A reconciler now resolves those rows and adopts the bytes rather than dropping the work. A Redis connection that moved to a new address wedged every read-blocked consumer, so completions stopped signalling while health still answered 200. Socket timeouts plus subscriber pings recover it. Installing more than one AI bundle left the shared venv multi-versioned and silently broke three tools. The installer now reconciles distributions to one version each. Converting an image to JXL at quality 1 through 4 returned a 500, because libjxl 0.7 rejects the distance those values compute. The quality is floored at what the encoder honours. A missing ffmpeg was also reported to the user as a corrupt upload; it now says the engine is unavailable. RAW uploads reached an unpatched LibRaw on arm64, so it is built from source at 0.22.2, and the release scan was split so it can fail on an unfixed critical instead of hiding it behind ignore-unfixed. ## Gates that could not fail Two mutation lanes ran zero mutants because Stryker crawled the gitignored docs build; coverage discarded its whole report on any failing test; the lint gate skipped root tests, scripts, and two workspaces; and several generated matrices counted a host missing ffmpeg as a passing tool. Each now measures what it claims. Full evidence and the outstanding release items are tracked locally and are not part of this branch.
517 lines
21 KiB
YAML
517 lines
21 KiB
YAML
name: Nightly
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "0 3 * * *"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
# Keep in sync with ci.yml's install step. tesseract-ocr + language packs are
|
|
# required by the built-in Fast OCR tier: without them the OCR integration
|
|
# tests throw "spawn tesseract ENOENT" and fail the coverage/matrix jobs.
|
|
SYSTEM_DEPS: libheif-examples libheif-plugin-x265 libheif-plugin-libde265 libimage-exiftool-perl libraw-bin imagemagick ghostscript libjxl-tools libopenjp2-tools ffmpeg qpdf tesseract-ocr tesseract-ocr-eng tesseract-ocr-deu tesseract-ocr-fra tesseract-ocr-spa tesseract-ocr-chi-sim tesseract-ocr-jpn
|
|
# See ci.yml: ryuk's Docker Hub pull is a recurring flake source; disable the reaper
|
|
# (tests/global-setup.ts stops its containers explicitly; runners are ephemeral).
|
|
TESTCONTAINERS_RYUK_DISABLED: "true"
|
|
|
|
jobs:
|
|
e2e-full:
|
|
name: E2E Full (${{ matrix.shard }}/4)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 60
|
|
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
env:
|
|
POSTGRES_USER: snapotter
|
|
POSTGRES_PASSWORD: snapotter
|
|
POSTGRES_DB: snapotter
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U snapotter"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 10
|
|
redis:
|
|
image: redis:8-alpine
|
|
ports:
|
|
- 6379:6379
|
|
options: >-
|
|
--health-cmd "redis-cli ping"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 10
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
shard: [1, 2, 3, 4]
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- name: Install system dependencies
|
|
run: |
|
|
read -r -a system_deps <<< "$SYSTEM_DEPS"
|
|
sudo apt-get update -qq
|
|
sudo apt-get install -y --no-install-recommends "${system_deps[@]}"
|
|
- uses: ./.github/actions/setup
|
|
- name: Get Playwright version
|
|
id: pw-version
|
|
run: echo "version=$(node -p "require('@playwright/test/package.json').version")" >> "$GITHUB_OUTPUT"
|
|
- name: Cache Playwright browsers
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: ~/.cache/ms-playwright
|
|
key: playwright-${{ runner.os }}-${{ steps.pw-version.outputs.version }}
|
|
- name: Install Playwright Chromium
|
|
run: pnpm playwright install --with-deps chromium
|
|
- name: Run full e2e suite (shard)
|
|
run: pnpm playwright test --project=chromium --shard=${{ matrix.shard }}/4
|
|
env:
|
|
PW_WORKERS: "2"
|
|
- name: Upload report on failure
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
if: failure()
|
|
with:
|
|
name: e2e-full-report-shard-${{ matrix.shard }}
|
|
path: playwright-report/
|
|
retention-days: 7
|
|
|
|
e2e-serial:
|
|
name: E2E Serial Bucket
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 60
|
|
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
env:
|
|
POSTGRES_USER: snapotter
|
|
POSTGRES_PASSWORD: snapotter
|
|
POSTGRES_DB: snapotter
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U snapotter"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 10
|
|
redis:
|
|
image: redis:8-alpine
|
|
ports:
|
|
- 6379:6379
|
|
options: >-
|
|
--health-cmd "redis-cli ping"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 10
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- name: Install system dependencies
|
|
run: |
|
|
read -r -a system_deps <<< "$SYSTEM_DEPS"
|
|
sudo apt-get update -qq
|
|
sudo apt-get install -y --no-install-recommends "${system_deps[@]}"
|
|
- uses: ./.github/actions/setup
|
|
- name: Get Playwright version
|
|
id: pw-version
|
|
run: echo "version=$(node -p "require('@playwright/test/package.json').version")" >> "$GITHUB_OUTPUT"
|
|
- name: Cache Playwright browsers
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: ~/.cache/ms-playwright
|
|
key: playwright-${{ runner.os }}-${{ steps.pw-version.outputs.version }}
|
|
- name: Install Playwright Chromium
|
|
run: pnpm playwright install --with-deps chromium
|
|
- name: Run serial bucket (global-state specs)
|
|
run: pnpm playwright test --project=chromium-serial --workers=1
|
|
# chromium-widths owns the exact CSS boundary and wide-screen assertions.
|
|
# It is five plain functional specs with no screenshot baselines, so it
|
|
# runs here rather than needing the platform-suffixed visual machinery.
|
|
- name: Run viewport-width bucket
|
|
run: pnpm playwright test --project=chromium-widths --workers=1
|
|
- name: Upload report on failure
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
if: failure()
|
|
with:
|
|
name: e2e-serial-report
|
|
path: playwright-report/
|
|
retention-days: 7
|
|
|
|
# The editor, the analytics opt-out flow and the AUTH_ENABLED=false mode each
|
|
# have their own Playwright config and, until now, no workflow at all: 174 + 9
|
|
# + 5 tests that collected and passed locally but gated nothing. All three need
|
|
# Postgres and Redis and build the web app themselves, so they share a runner.
|
|
e2e-surfaces:
|
|
name: E2E Editor + Analytics Opt-Out + No-Auth
|
|
runs-on: ubuntu-latest
|
|
# The editor suite is 174 tests pinned to workers: 1 by its own config and
|
|
# took 23.4 minutes on a loaded dev machine, so leave real headroom for it
|
|
# plus the apt install, the browser download and the two smaller suites.
|
|
timeout-minutes: 60
|
|
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
env:
|
|
POSTGRES_USER: snapotter
|
|
POSTGRES_PASSWORD: snapotter
|
|
POSTGRES_DB: snapotter
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U snapotter"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 10
|
|
redis:
|
|
image: redis:8-alpine
|
|
ports:
|
|
- 6379:6379
|
|
options: >-
|
|
--health-cmd "redis-cli ping"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 10
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- name: Install system dependencies
|
|
run: |
|
|
read -r -a system_deps <<< "$SYSTEM_DEPS"
|
|
sudo apt-get update -qq
|
|
sudo apt-get install -y --no-install-recommends "${system_deps[@]}"
|
|
- uses: ./.github/actions/setup
|
|
- name: Get Playwright version
|
|
id: pw-version
|
|
run: echo "version=$(node -p "require('@playwright/test/package.json').version")" >> "$GITHUB_OUTPUT"
|
|
- name: Cache Playwright browsers
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: ~/.cache/ms-playwright
|
|
key: playwright-${{ runner.os }}-${{ steps.pw-version.outputs.version }}
|
|
- name: Install Playwright Chromium
|
|
run: pnpm playwright install --with-deps chromium
|
|
- name: Run editor suite
|
|
run: pnpm playwright test --config playwright.editor.config.ts
|
|
env:
|
|
PW_WORKERS: "2"
|
|
- name: Run analytics opt-out suite
|
|
# The in-repo docker/feature-manifest.json makes the API believe it is
|
|
# inside a container and mkdir /data; this config does not pin DATA_DIR
|
|
# itself, so pin it here the way playwright.config.ts does.
|
|
run: pnpm test:e2e:analytics
|
|
env:
|
|
DATA_DIR: ${{ runner.temp }}/analytics-local-data
|
|
- name: Run no-auth mode suite
|
|
# AUTH_ENABLED=false injects a synthetic anonymous admin. Nothing else in
|
|
# CI exercises that path, so a regression only surfaced on a user's box.
|
|
run: pnpm test:e2e:noauth
|
|
- name: Upload report on failure
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
if: failure()
|
|
with:
|
|
name: e2e-surfaces-report
|
|
path: playwright-report/
|
|
retention-days: 7
|
|
|
|
e2e-cross-browser:
|
|
name: E2E Cross-Browser (Firefox + WebKit)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
env:
|
|
POSTGRES_USER: snapotter
|
|
POSTGRES_PASSWORD: snapotter
|
|
POSTGRES_DB: snapotter
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U snapotter"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 10
|
|
redis:
|
|
image: redis:8-alpine
|
|
ports:
|
|
- 6379:6379
|
|
options: >-
|
|
--health-cmd "redis-cli ping"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 10
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- uses: ./.github/actions/setup
|
|
- name: Get Playwright version
|
|
id: pw-version
|
|
run: echo "version=$(node -p "require('@playwright/test/package.json').version")" >> "$GITHUB_OUTPUT"
|
|
- name: Cache Playwright browsers
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: ~/.cache/ms-playwright
|
|
key: playwright-all-${{ runner.os }}-${{ steps.pw-version.outputs.version }}
|
|
- name: Install Playwright browsers
|
|
run: pnpm playwright install --with-deps chromium firefox webkit
|
|
- name: Run cross-browser spec
|
|
run: pnpm playwright test --project=firefox --project=webkit
|
|
env:
|
|
PW_WORKERS: "1"
|
|
- name: Upload report on failure
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
if: failure()
|
|
with:
|
|
name: e2e-cross-browser-report
|
|
path: playwright-report/
|
|
retention-days: 7
|
|
|
|
e2e-device-matrix:
|
|
name: E2E Device Matrix (mobile + tablet)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
env:
|
|
POSTGRES_USER: snapotter
|
|
POSTGRES_PASSWORD: snapotter
|
|
POSTGRES_DB: snapotter
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U snapotter"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 10
|
|
redis:
|
|
image: redis:8-alpine
|
|
ports:
|
|
- 6379:6379
|
|
options: >-
|
|
--health-cmd "redis-cli ping"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 10
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- name: Install system dependencies
|
|
run: |
|
|
read -r -a system_deps <<< "$SYSTEM_DEPS"
|
|
sudo apt-get update -qq
|
|
sudo apt-get install -y --no-install-recommends "${system_deps[@]}"
|
|
- uses: ./.github/actions/setup
|
|
- name: Get Playwright version
|
|
id: pw-version
|
|
run: echo "version=$(node -p "require('@playwright/test/package.json').version")" >> "$GITHUB_OUTPUT"
|
|
- name: Cache Playwright browsers
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: ~/.cache/ms-playwright
|
|
key: playwright-all-${{ runner.os }}-${{ steps.pw-version.outputs.version }}
|
|
- name: Install Playwright browsers (chromium + webkit)
|
|
run: pnpm playwright install --with-deps chromium webkit
|
|
- name: Run all device projects
|
|
run: pnpm playwright test --project=mobile-chromium --project=mobile-webkit --project=tablet-webkit --project=tablet-chromium --grep-invert "@visual"
|
|
env:
|
|
PW_WORKERS: "2"
|
|
- name: Upload report on failure
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
if: failure()
|
|
with:
|
|
name: e2e-device-matrix-report
|
|
path: playwright-report/
|
|
retention-days: 7
|
|
|
|
docker-e2e:
|
|
name: Docker Container E2E
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 60
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- name: Run container test suite
|
|
# Attribute the job to test-unit: it runs the full integration suite
|
|
# against the container's real binaries (ffmpeg/qpdf/tesseract/...), which
|
|
# is the in-container validation this job exists for. --exit-code-from
|
|
# test-e2e never worked: --abort-on-container-exit (which it implies) kills
|
|
# test-e2e the moment test-unit exits, so test-e2e's SIGKILL (137) became
|
|
# the result. Browser e2e is covered by the E2E Full/Serial/Cross-Browser
|
|
# jobs; running test-e2e in-container too is a separate follow-up (it also
|
|
# would not fit this job's 60-minute budget alongside test-unit).
|
|
run: docker compose -f docker/docker-compose.test.yml up --build --exit-code-from test-unit
|
|
|
|
extended-matrix:
|
|
name: Extended Matrix + Fuzz (${{ matrix.shard }}/4)
|
|
runs-on: ubuntu-latest
|
|
# The full format x tool matrix plus property fuzz overran a single 90-min
|
|
# job. Shard it four ways (mirroring E2E Full) so each runner takes a quarter
|
|
# of the integration files; the generous per-shard ceiling absorbs the fact
|
|
# that the heavy format-matrix-* files cluster onto one shard.
|
|
timeout-minutes: 120
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
shard: [1, 2, 3, 4]
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- name: Install system dependencies
|
|
run: |
|
|
read -r -a system_deps <<< "$SYSTEM_DEPS"
|
|
sudo apt-get update -qq
|
|
sudo apt-get install -y --no-install-recommends "${system_deps[@]}"
|
|
- name: Allow ImageMagick to read EPS/PS via Ghostscript delegate
|
|
run: |
|
|
POLICY_FILE=$(find /etc/ImageMagick* -name policy.xml 2>/dev/null | head -1)
|
|
if [ -n "$POLICY_FILE" ]; then
|
|
sudo sed -i 's/<policy domain="coder" rights="none" pattern="EPS"/<policy domain="coder" rights="read" pattern="EPS"/' "$POLICY_FILE"
|
|
sudo sed -i 's/<policy domain="coder" rights="none" pattern="PS"/<policy domain="coder" rights="read" pattern="PS"/' "$POLICY_FILE"
|
|
fi
|
|
- uses: ./.github/actions/setup
|
|
- name: Pre-pull testcontainer images (retry transient Docker Hub errors)
|
|
run: |
|
|
for img in postgres:17-alpine redis:8-alpine; do
|
|
ok=
|
|
for attempt in 1 2 3 4 5; do
|
|
if docker pull "$img"; then ok=1; break; fi
|
|
echo "::warning::docker pull $img failed (attempt $attempt/5); retrying in $((attempt * 5))s"
|
|
sleep "$((attempt * 5))"
|
|
done
|
|
[ -n "$ok" ] || { echo "::error::could not pull $img after 5 attempts"; exit 1; }
|
|
done
|
|
- name: Run integration suite with full matrix and fuzz enabled
|
|
run: pnpm vitest run tests/integration/ --reporter=verbose --shard=${{ matrix.shard }}/4
|
|
env:
|
|
FULL_MATRIX: "1"
|
|
FUZZ: "1"
|
|
FUZZ_RUNS: "50"
|
|
REQUIRE_AI_FEATURES: "1"
|
|
# Full-matrix tests iterate every format x tool; with 4 forks the heavy
|
|
# media conversions starve and hit the 30s default. Fewer forks (more
|
|
# CPU each) plus a generous timeout keeps them from flaking.
|
|
VITEST_MAX_FORKS: "2"
|
|
VITEST_TEST_TIMEOUT: "600000"
|
|
VITEST_HOOK_TIMEOUT: "120000"
|
|
|
|
api-fuzz:
|
|
name: Schemathesis API Fuzz
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
env:
|
|
POSTGRES_USER: snapotter
|
|
POSTGRES_PASSWORD: snapotter
|
|
POSTGRES_DB: snapotter
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U snapotter"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 10
|
|
redis:
|
|
image: redis:8-alpine
|
|
ports:
|
|
- 6379:6379
|
|
options: >-
|
|
--health-cmd "redis-cli ping"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 10
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- name: Install system dependencies
|
|
run: |
|
|
read -r -a system_deps <<< "$SYSTEM_DEPS"
|
|
sudo apt-get update -qq
|
|
sudo apt-get install -y --no-install-recommends "${system_deps[@]}"
|
|
- uses: ./.github/actions/setup
|
|
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
|
|
with:
|
|
python-version: "3.12"
|
|
- name: Install Schemathesis
|
|
run: pip install schemathesis
|
|
- name: Start API server
|
|
run: |
|
|
mkdir -p /tmp/st-data
|
|
AUTH_ENABLED=false ANALYTICS_ENABLED=false SYNC_WAIT_MS=0 \
|
|
DATABASE_URL=postgres://snapotter:snapotter@localhost:5432/snapotter \
|
|
REDIS_URL=redis://localhost:6379 \
|
|
WORKSPACE_PATH=/tmp/st-data/workspace DATA_DIR=/tmp/st-data \
|
|
pnpm --filter @snapotter/api dev &
|
|
for i in $(seq 1 60); do
|
|
if curl -fsS http://localhost:13490/api/v1/health > /dev/null 2>&1; then
|
|
echo "API up after ${i}s"; exit 0
|
|
fi
|
|
sleep 1
|
|
done
|
|
echo "API failed to start"; exit 1
|
|
- name: Fuzz tool endpoints from the OpenAPI spec
|
|
run: |
|
|
# This fuzz targets the async tool-factory endpoints: they validate the
|
|
# request, enqueue a job, and return 202 immediately (the server is
|
|
# started above with SYNC_WAIT_MS=0). Excluded are the feature-gated
|
|
# AI/media tools and the handful of tools with bespoke handlers that
|
|
# process synchronously in-request (meme-generator, collage, stitch,
|
|
# compose, beautify, vectorize, ...). On adversarial input that
|
|
# in-request work is unbounded and trips the request timeout, so those
|
|
# tools are fuzzed by the integration and e2e suites instead.
|
|
#
|
|
# --suppress-health-check all: the tool endpoints need a real uploaded
|
|
# file, so the fuzzer's random bytes get rejected (404) and Hypothesis's
|
|
# filter_too_much check would fail the run. Those checks grade data
|
|
# generation quality, not API correctness; not_a_server_error still runs
|
|
# on every generated case (5000+ per run).
|
|
schemathesis run http://localhost:13490/api/v1/openapi.yaml \
|
|
--url http://localhost:13490 \
|
|
--checks not_a_server_error \
|
|
--suppress-health-check all \
|
|
--request-timeout 120 \
|
|
--include-path-regex "^/api/v1/(tools|health|info)" \
|
|
--exclude-path-regex "/tools/(audio|video)/|/(remove-background|remove-gif-background|upscale|html-to-image|blur-faces|erase-object|ocr|ocr-pdf|colorize|enhance-faces|noise-removal|smart-crop|red-eye-removal|restore-photo|passport-photo|transparency-fixer|ai-canvas-expand|transcribe-audio|auto-subtitles|background-replace|blur-background|meme-generator|compare|stitch|collage|bulk-rename|watermark-image|vectorize|find-duplicates|split|sign-pdf|beautify|favicon|color-palette|compose)(/[a-z-]+)?$" \
|
|
--max-examples 25 \
|
|
--report junit \
|
|
--report-dir st-report
|
|
- name: Upload fuzz report
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
if: always()
|
|
with:
|
|
name: schemathesis-report
|
|
path: st-report/
|
|
retention-days: 14
|
|
|
|
coverage-report:
|
|
name: Coverage Report
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 90
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- name: Install system dependencies
|
|
run: |
|
|
read -r -a system_deps <<< "$SYSTEM_DEPS"
|
|
sudo apt-get update -qq
|
|
sudo apt-get install -y --no-install-recommends "${system_deps[@]}"
|
|
- name: Allow ImageMagick to read EPS/PS via Ghostscript delegate
|
|
run: |
|
|
POLICY_FILE=$(find /etc/ImageMagick* -name policy.xml 2>/dev/null | head -1)
|
|
if [ -n "$POLICY_FILE" ]; then
|
|
sudo sed -i 's/<policy domain="coder" rights="none" pattern="EPS"/<policy domain="coder" rights="read" pattern="EPS"/' "$POLICY_FILE"
|
|
sudo sed -i 's/<policy domain="coder" rights="none" pattern="PS"/<policy domain="coder" rights="read" pattern="PS"/' "$POLICY_FILE"
|
|
fi
|
|
- uses: ./.github/actions/setup
|
|
- name: Run tests with coverage
|
|
run: pnpm vitest run --coverage tests/unit/ tests/integration/
|
|
# Coverage instrumentation slows every test; fewer forks + a longer
|
|
# timeout keep slow media tests (e.g. qr-generate) from timing out.
|
|
env:
|
|
VITEST_MAX_FORKS: "2"
|
|
VITEST_TEST_TIMEOUT: "300000"
|
|
VITEST_HOOK_TIMEOUT: "120000"
|
|
- name: Upload coverage artifact
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: coverage-report
|
|
path: coverage/
|
|
retention-days: 14
|