feat(nodes): per-field Copy NodeInfo with overwrite, and fix the MAC address display (#4244) #8305
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| pull_request: | |
| branches: [ main, develop ] | |
| types: [ opened, synchronize, reopened ] | |
| jobs: | |
| test: | |
| name: Test Suite | |
| runs-on: ubuntu-latest | |
| services: | |
| postgres: | |
| image: postgres:16 | |
| env: | |
| POSTGRES_USER: test | |
| POSTGRES_PASSWORD: test | |
| POSTGRES_DB: meshmonitor_test | |
| ports: | |
| - 5433:5432 | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| mysql: | |
| image: mysql:8 | |
| env: | |
| MYSQL_ROOT_PASSWORD: root | |
| MYSQL_USER: test | |
| MYSQL_PASSWORD: test | |
| MYSQL_DATABASE: meshmonitor_test | |
| ports: | |
| - 3307:3306 | |
| options: >- | |
| --health-cmd "mysqladmin ping -h localhost" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| strategy: | |
| matrix: | |
| node-version: [20.x, 22.x, 24.x, 25.x] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| submodules: recursive # Initialize protobufs submodule for tests | |
| - name: Setup Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: 'npm' | |
| - name: Cache dependencies | |
| uses: actions/cache@v6 | |
| with: | |
| path: ~/.npm | |
| key: ${{ runner.os }}-node-${{ matrix.node-version }}-${{ hashFiles('**/package-lock.json') }} | |
| restore-keys: | | |
| ${{ runner.os }}-node-${{ matrix.node-version }}- | |
| ${{ runner.os }}-node- | |
| - name: Install dependencies | |
| run: npm install --legacy-peer-deps | |
| - name: Run lint ratchet | |
| # BLOCKING: fails only on new violations above the checked-in baseline. | |
| # Existing debt is frozen in eslint-baseline.json and burns down over time. | |
| # Regenerate baseline: npm run lint:baseline. Tracking: #3962 Task 1.4. | |
| run: npm run lint:ci | |
| - name: Run type checking | |
| run: npm run typecheck | |
| # Test-file type check runs on ONE Node version (non-blocking; tracks | |
| # toward a clean tsconfig.tests). Coverage generation + Codecov upload were | |
| # removed (#4172): they ran on a single leg, produced no enforced signal | |
| # (no token, no thresholds, no PR status check, no badge — Codecov was | |
| # already fail_ci_if_error:false), and @vitest/coverage-v8 hung for 30+ min | |
| # on Node 24, repeatedly blocking merges. `npm run test:coverage` remains | |
| # available for ad-hoc local reports. | |
| - name: Type-check tests (non-blocking) | |
| if: matrix.node-version == '24.x' | |
| run: npm run typecheck:tests | |
| # NON-BLOCKING: ~283 pre-existing test-type errors (mock/signature drift). | |
| # Flip to blocking (remove continue-on-error) once `npm run typecheck:tests` is clean (0 errors). | |
| # Tracking: remediation epic #3962 Task 1.2. | |
| continue-on-error: true | |
| - name: Run tests | |
| run: npm run test:run | |
| build: | |
| name: Build Check | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| submodules: recursive # Initialize protobufs submodule | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '24.x' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm install --legacy-peer-deps | |
| - name: Build frontend | |
| run: npm run build | |
| - name: Build server | |
| run: npm run build:server | |
| - name: Check build artifacts | |
| run: | | |
| echo "Checking frontend build..." | |
| ls -la dist/ | |
| echo "Checking server build..." | |
| ls -la dist/server/ | |
| docker: | |
| name: Docker Build | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| submodules: recursive | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Build Docker image | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| push: false | |
| load: true | |
| tags: meshmonitor:test | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Test Docker image | |
| run: | | |
| docker run --rm meshmonitor:test node --version | |
| docker run --rm meshmonitor:test ls -la /app/ | |
| security: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| - name: Install Trivy | |
| run: | | |
| sudo apt-get install -y wget apt-transport-https gnupg lsb-release | |
| wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null | |
| echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/trivy.list | |
| sudo apt-get update | |
| sudo apt-get install -y trivy | |
| - name: Run Trivy vulnerability scanner | |
| run: trivy fs --scanners vuln --format sarif --output trivy-results.sarif --severity HIGH,CRITICAL . | |
| - name: Upload Trivy results to GitHub Security | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| - name: Dependency audit | |
| run: npm audit --audit-level=moderate | |
| continue-on-error: true # Don't fail on audit issues for now | |
| clamav: | |
| name: ClamAV Scan | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| - name: Install & update ClamAV | |
| run: | | |
| set -e | |
| sudo apt-get update | |
| sudo apt-get install -y clamav clamav-freshclam | |
| sudo systemctl stop clamav-freshclam || true | |
| sudo freshclam --verbose | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: 22.x | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm install --legacy-peer-deps | |
| - name: Verify ClamAV detects EICAR signature | |
| run: | | |
| set -euo pipefail | |
| printf 'X5O!P%%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > eicar.com | |
| status=0 | |
| clamscan eicar.com > eicar.log 2>&1 || status=$? | |
| cat eicar.log | |
| if [ "$status" -ne 1 ]; then | |
| echo "ClamAV failed to detect EICAR test signature" >&2 | |
| exit 1 | |
| fi | |
| rm -f eicar.com eicar.log | |
| - name: Scan source tree | |
| run: | | |
| set -euo pipefail | |
| clamscan -ri --exclude-dir='^\.git$' . | tee clamav.log | |
| if grep -qE 'Infected files: [1-9][0-9]*' clamav.log; then | |
| echo "ClamAV found infected files!" >&2 | |
| grep 'FOUND' clamav.log >&2 | |
| exit 1 | |
| fi | |
| - name: Upload scan results | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: clamav-scan-results | |
| path: clamav.log | |
| pr-comment: | |
| name: PR Comment | |
| runs-on: ubuntu-latest | |
| needs: [test, build, docker] | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Comment on PR | |
| uses: actions/github-script@v9 | |
| continue-on-error: true # Don't fail if we can't comment | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| script: | | |
| const issue_number = context.payload.pull_request.number; | |
| const { owner, repo } = context.repo; | |
| const comment = `## ✅ CI Checks Passed | |
| All tests and builds completed successfully! | |
| - **Tests**: All unit tests passing | |
| - **Type Check**: No TypeScript errors | |
| - **Build**: Frontend and server built successfully | |
| - **Docker**: Image builds successfully | |
| Ready for review! 🚀`; | |
| // Check if we already commented | |
| const comments = await github.rest.issues.listComments({ | |
| owner, | |
| repo, | |
| issue_number, | |
| }); | |
| const botComment = comments.data.find(comment => | |
| comment.user.type === 'Bot' && | |
| comment.body.includes('CI Checks') | |
| ); | |
| if (botComment) { | |
| // Update existing comment | |
| await github.rest.issues.updateComment({ | |
| owner, | |
| repo, | |
| comment_id: botComment.id, | |
| body: comment | |
| }); | |
| } else { | |
| // Create new comment | |
| await github.rest.issues.createComment({ | |
| owner, | |
| repo, | |
| issue_number, | |
| body: comment | |
| }); | |
| } |