test: add property-based fuzz coverage for Zod validators (#2384) #251
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Backend CI | |
| on: | |
| push: | |
| branches: ["main"] | |
| paths: | |
| - 'backend/**' | |
| pull_request: | |
| branches: ["main"] | |
| paths: | |
| - 'backend/**' | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| env: | |
| NODE_VERSION: '20' | |
| jobs: | |
| security_scan: | |
| name: Dependency Vulnerability Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: 'npm' | |
| cache-dependency-path: backend/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| working-directory: backend | |
| - name: Create npm audit report JSON | |
| run: npm audit --json > audit-report.json || true | |
| working-directory: backend | |
| - name: Enforce vulnerability gate | |
| run: npm run security:scan | |
| working-directory: backend | |
| - name: Upload audit report artifact | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: backend-audit-report | |
| path: backend/audit-report.json | |
| retention-days: 14 | |
| test: | |
| name: Test and Coverage | |
| runs-on: ubuntu-latest | |
| needs: security_scan | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: 'npm' | |
| cache-dependency-path: backend/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| working-directory: backend | |
| - name: Type check | |
| run: npx tsc --noEmit | |
| working-directory: backend | |
| - name: Run tests with coverage | |
| run: npm run test:coverage | |
| working-directory: backend | |
| - name: Run performance regression tests | |
| run: npx jest "perf/perf.test.ts" --no-coverage | |
| working-directory: backend | |
| sbom: | |
| name: Generate SBOM Artifact | |
| runs-on: ubuntu-latest | |
| needs: security_scan | |
| if: github.event_name == 'pull_request' || github.event_name == 'release' || github.ref == 'refs/heads/main' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: 'npm' | |
| cache-dependency-path: backend/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| working-directory: backend | |
| - name: Generate CycloneDX SBOM | |
| run: npm run sbom:generate | |
| working-directory: backend | |
| - name: Validate generated SBOM | |
| run: npm run sbom:check | |
| working-directory: backend | |
| - name: Upload SBOM artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: backend-sbom-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.ref_name }} | |
| path: backend/sbom/backend-sbom.cdx.json | |
| retention-days: 90 |