dependency fix + test reporting

Author: mkasperczyk90

.github/dependabot.yml

@@ -11,6 +11,8 @@ updates:
         patterns: ['*']
 
   # The two SPAs and the two e2e harnesses each have their own lockfile.
+  # Group aggressively so a weekly run lands ~2 PRs per directory (safe vs. breaking),
+  # not one-per-package: minor/patch in one PR, the riskier majors batched in another.
   - package-ecosystem: npm
     directories:
       - '/src/web/admin'
@@ -23,9 +25,14 @@ updates:
     groups:
       npm-minor-patch:
         update-types: ['minor', 'patch']
+      npm-major:
+        update-types: ['major']
 
-  # Keep the workflow actions themselves current.
+  # Keep the workflow actions themselves current — all action bumps in a single PR.
   - package-ecosystem: github-actions
     directory: '/'
     schedule:
       interval: weekly
+    groups:
+      github-actions:
+        patterns: ['*']

.github/workflows/backend.yml

@@ -38,8 +38,11 @@ jobs:
   build-test:
     name: Build & test
     runs-on: ubuntu-latest   # Docker is preinstalled here — the integration tests need it (Testcontainers).
+    permissions:
+      contents: read
+      checks: write          # let the test reporter publish a per-test Check run.
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Setup .NET (from global.json)
         uses: actions/setup-dotnet@v5
@@ -60,15 +63,38 @@ jobs:
       - name: Build (Release, warnings-as-errors)
         run: dotnet build Warehouse.slnx -c Release --no-restore
 
-      # To also collect coverage, add the `coverlet.collector` package to the test projects
-      # and append: --collect "XPlat Code Coverage"
       - name: Test (unit + architecture + integration)
         run: >
           dotnet test Warehouse.slnx -c Release --no-build
-          --logger "trx;LogFileName=test-results.trx"
+          --logger trx
+          --collect "XPlat Code Coverage"
           --results-directory ${{ github.workspace }}/TestResults
 
-      - name: Upload test results
+      # Surfaces a per-test pass/fail Check (with failure annotations on the PR) from the TRX files,
+      # so you can see which tests broke without downloading the artifact. Runs even when tests fail.
+      - name: Publish test report
+        if: ${{ !cancelled() }}
+        uses: dorny/test-reporter@v3
+        with:
+          name: Backend tests
+          path: TestResults/**/*.trx
+          reporter: dotnet-trx
+          fail-on-error: false
+
+      # Turn the cobertura output (from coverlet.collector) into a markdown table on the run's summary page.
+      - name: Coverage summary
+        if: ${{ !cancelled() }}
+        uses: danielpalme/ReportGenerator-GitHub-Action@5
+        with:
+          reports: ${{ github.workspace }}/TestResults/**/coverage.cobertura.xml
+          targetdir: ${{ github.workspace }}/coveragereport
+          reporttypes: MarkdownSummaryGithub
+
+      - name: Append coverage to job summary
+        if: ${{ !cancelled() }}
+        run: cat ${{ github.workspace }}/coveragereport/SummaryGithub.md >> "$GITHUB_STEP_SUMMARY" || true
+
+      - name: Upload test results & coverage
         if: ${{ !cancelled() }}
         uses: actions/upload-artifact@v7
         with:
@@ -93,7 +119,7 @@ jobs:
           - name: logistics-api
             project: src/Services/Logistics/Warehouse.Logistics.Api/Warehouse.Logistics.Api.csproj
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Setup .NET (from global.json)
         uses: actions/setup-dotnet@v5

.github/workflows/codeql.yml

@@ -30,7 +30,7 @@ jobs:
           - language: javascript-typescript
             build-mode: none
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/dependency-review.yml

@@ -0,0 +1,25 @@
+name: Dependency review
+
+# On every PR, flag dependencies that introduce known vulnerabilities or disallowed licenses
+# (reads the GitHub dependency graph — covers both NuGet and npm). No deployment.
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    name: Review
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write   # post the findings summary as a PR comment
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Dependency review
+        uses: actions/dependency-review-action@v5
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: on-failure

.github/workflows/docker.yml

@@ -36,6 +36,9 @@ jobs:
   build:
     name: ${{ matrix.name }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write   # upload the Trivy SARIF to the Security tab.
     strategy:
       fail-fast: false
       matrix:
@@ -61,7 +64,7 @@ jobs:
             context: src/web/terminal
             dockerfile: src/web/terminal/Dockerfile
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Setup Buildx
         uses: docker/setup-buildx-action@v4
@@ -72,6 +75,40 @@ jobs:
           context: ${{ matrix.context }}
           file: ${{ matrix.dockerfile }}
           push: false
+          load: true             # keep the image locally so it can be scanned below.
           tags: warehouse-${{ matrix.name }}:ci
           cache-from: type=gha,scope=${{ matrix.name }}
           cache-to: type=gha,scope=${{ matrix.name }},mode=max
+
+      # Scan the built image for known CVEs. Report-only (exit-code 0) — results land in the
+      # Security tab via SARIF rather than blocking the build; tighten exit-code later to gate.
+      - name: Scan image (Trivy)
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: warehouse-${{ matrix.name }}:ci
+          format: sarif
+          output: trivy-${{ matrix.name }}.sarif
+          severity: CRITICAL,HIGH
+          exit-code: '0'
+
+      - name: Upload Trivy results
+        if: ${{ !cancelled() }}
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: trivy-${{ matrix.name }}.sarif
+          category: trivy-${{ matrix.name }}
+
+      # Software bill of materials for the image — useful artifact for supply-chain auditing.
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          image: warehouse-${{ matrix.name }}:ci
+          format: spdx-json
+          output-file: sbom-${{ matrix.name }}.spdx.json
+
+      - name: Upload SBOM
+        uses: actions/upload-artifact@v7
+        with:
+          name: sbom-${{ matrix.name }}
+          path: sbom-${{ matrix.name }}.spdx.json
+          if-no-files-found: warn

.github/workflows/e2e.yml

@@ -25,6 +25,9 @@ jobs:
   e2e:
     name: ${{ matrix.app }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write          # let the test reporter publish a per-test Check run.
     strategy:
       fail-fast: false
       matrix:
@@ -38,10 +41,10 @@ jobs:
     env:
       CI: '1'
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Setup Node 20
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: 20
           cache: npm
@@ -69,6 +72,17 @@ jobs:
         working-directory: ${{ matrix.e2e }}
         run: npm test
 
+      # Per-test pass/fail Check from Playwright's JUnit output (the `github` reporter also
+      # annotates failures inline on the PR). Runs even when the suite fails.
+      - name: Publish test report
+        if: ${{ !cancelled() }}
+        uses: dorny/test-reporter@v3
+        with:
+          name: E2E tests (${{ matrix.app }})
+          path: ${{ matrix.e2e }}/test-results/junit.xml
+          reporter: java-junit
+          fail-on-error: false
+
       - name: Upload Playwright report
         if: ${{ !cancelled() }}
         uses: actions/upload-artifact@v7

.github/workflows/frontend.yml

@@ -35,14 +35,17 @@ jobs:
           - app: terminal
             dir: src/web/terminal
             build: build:web   # expo export --platform web
+    permissions:
+      contents: read
+      checks: write          # let the test reporter publish a per-test Check run.
     defaults:
       run:
         working-directory: ${{ matrix.dir }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Setup Node 20
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: 20
           cache: npm
@@ -62,8 +65,20 @@ jobs:
       - name: Lint
         run: npm run lint --if-present
 
+      # Only admin has a test:run script; --if-present makes this a no-op for terminal.
+      # The extra args make vitest also emit JUnit for the test reporter below.
       - name: Unit tests
-        run: npm run test:run --if-present
+        run: npm run test:run --if-present -- --reporter=default --reporter=junit --outputFile=test-results/vitest-junit.xml
+
+      # Per-test pass/fail Check from the vitest JUnit output (admin only).
+      - name: Publish test report
+        if: ${{ !cancelled() && matrix.app == 'admin' }}
+        uses: dorny/test-reporter@v3
+        with:
+          name: Frontend tests (admin)
+          path: ${{ matrix.dir }}/test-results/vitest-junit.xml
+          reporter: java-junit
+          fail-on-error: false
 
       - name: Build
         run: npm run ${{ matrix.build }}

Directory.Packages.props

@@ -39,6 +39,7 @@
     <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
     <PackageVersion Include="Yarp.ReverseProxy" Version="2.3.0" />
     <!-- Tests -->
+    <PackageVersion Include="coverlet.collector" Version="6.0.2" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.6.0" />
     <PackageVersion Include="NetArchTest.Rules" Version="1.3.2" />
     <PackageVersion Include="NSubstitute" Version="5.3.0" />

tests/Warehouse.ArchitectureTests/Warehouse.ArchitectureTests.csproj

@@ -1,6 +1,10 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <ItemGroup>
+    <PackageReference Include="coverlet.collector">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" />
     <PackageReference Include="NetArchTest.Rules" />

tests/Warehouse.Logistics.IntegrationTests/Warehouse.Logistics.IntegrationTests.csproj

@@ -1,6 +1,10 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <ItemGroup>
+    <PackageReference Include="coverlet.collector">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" />
     <PackageReference Include="Respawn" />