Skip to content

fix(ci): resolve failing CI jobs#31

Merged
leonardocustodio merged 3 commits into
mainfrom
lrubasze/fix-esbuild-audit
Jun 16, 2026
Merged

fix(ci): resolve failing CI jobs#31
leonardocustodio merged 3 commits into
mainfrom
lrubasze/fix-esbuild-audit

Conversation

@lrubasze

@lrubasze lrubasze commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

Fixes the failing CI jobs:

  • Dependency Audit
    Pin esbuild: ^0.28.1 via overrides to clear the advisory (high RCE + low file-read).
  • Playwright install
    Run playwright install from apps/host so the installed browser matches the pinned version (was run from repo root → fetched latest → wrong build, tests died at chromium.launch()).
  • Test build config
    Set VITE_NETWORKS on the test Build steps; without it the host shell throws on boot and never mounts the protocol/app iframes, so every test timed out.

Note: A few E2E product tests still fail (paired transactions return error). These are unrelated to the CI-config fixes here.

@github-actions

github-actions Bot commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

Bundle Size Report

Chunks over 500 KB:

File Raw Brotli Gzip
host/assets/paseo.smol-DboPaEh1.json 1.84 MB 941.7 KB 1019.4 KB
host/assets/paseo-people-next.smol.json 3.36 MB 1.68 MB 1.82 MB
host/assets/previewnet.smol.json 810.7 KB 116.0 KB 149.3 KB
host/assets/smoldot_worker.js 2.92 MB 2.19 MB 2.20 MB
Total 10.35 MB (-384 B) 5.38 MB (-656 B) (-48%) 5.72 MB (-745 B)
All files
File Raw Brotli Gzip
host/.well-known/apple-app-site-association 738 B 738 B 738 B
host/.well-known/assetlinks.json 986 B 986 B 986 B
host/assets/auth.js 462.5 KB 175.4 KB (-16 B) 221.5 KB
host/assets/blake2.js 10.2 KB 3.2 KB (-2 B) 3.7 KB (-2 B)
host/assets/bridge.js 5.4 KB 1.8 KB (-8 B) 2.1 KB (-2 B)
host/assets/browser.js 22.9 KB 7.6 KB 8.6 KB
host/assets/client.js 93.0 KB 27.4 KB (+14 B) 30.1 KB (+1 B)
host/assets/container.js 53.9 KB 13.2 KB (-1 B) 14.8 KB (-4 B)
host/assets/dist.js 28.8 KB (+3.9 KB) 10.0 KB (+2.3 KB) 11.1 KB (+2.5 KB)
host/assets/dist.js 24.9 KB 7.7 KB 8.6 KB
host/assets/dist.js 20.6 KB (-4.3 KB) 4.8 KB (-2.9 KB) 5.4 KB (-3.2 KB)
host/assets/dotli-debug-bus.js 495 B 495 B 495 B
host/assets/index.css 46.6 KB 7.2 KB 8.1 KB
host/assets/index.js 102.9 KB 27.8 KB (+3 B) 32.3 KB (-2 B)
host/assets/log.js 972 B 972 B 972 B
host/assets/manifest.js 22.6 KB 7.3 KB (-39 B) 8.0 KB
host/assets/mode.js 1.7 KB 600 B 664 B
host/assets/nanoevents.js 215 B 215 B 215 B
host/assets/network.js 3.7 KB 1.4 KB 1.6 KB
host/assets/nova-scale.js 6.7 KB 2.6 KB 2.9 KB
host/assets/panel.js 84.9 KB 23.1 KB (+8 B) 26.3 KB
host/assets/paseo.smol-DboPaEh1.json 1.84 MB 941.7 KB 1019.4 KB
host/assets/paseo-people-next.smol.json 3.36 MB 1.68 MB 1.82 MB
host/assets/paseo.smol.json 129.8 KB 22.9 KB 31.8 KB
host/assets/previewnet.smol.json 810.7 KB 116.0 KB 149.3 KB
host/assets/resolve.js 154 B 154 B 154 B
host/assets/rolldown-runtime.js 694 B 694 B 694 B
host/assets/rpc-resolve.js 2.5 KB 1.0 KB (-18 B) 1.2 KB (-2 B)
host/assets/shared-mode.js 1.9 KB 791 B (-1 B) 894 B (-1 B)
host/assets/smoldot_worker.js 2.92 MB 2.19 MB 2.20 MB
host/assets/spans.js 1.6 KB 765 B 914 B
host/assets/src.js 1.9 KB 893 B (+1 B) 1000 B
host/assets/styles.css 15.1 KB 3.2 KB 3.8 KB
host/assets/substrate-client.js 7.2 KB 2.7 KB (+2 B) 3.0 KB (-5 B)
host/assets/ws.js 25.8 KB 8.4 KB (+2 B) 9.1 KB
host/dotli.png 11.5 KB 11.5 KB 11.5 KB
host/favicon.svg 1.8 KB 1.8 KB 1.8 KB
host/host-sw.js 2.9 KB 1.1 KB (-5 B) 1.3 KB (-1 B)
host/icon-192.png 12.5 KB 12.5 KB 12.5 KB
host/icon-512.png 42.8 KB 42.8 KB 42.8 KB
host/index.html 20.3 KB 4.5 KB (+9 B) 5.5 KB (+1 B)
host/manifest.webmanifest 441 B 441 B 441 B
host/workbox.js 14.8 KB 4.6 KB 5.1 KB
sandbox/app-sw.js 8.7 KB 2.8 KB (+2 B) 3.2 KB
sandbox/assets/bitswap-bridge.js 840 B 840 B 840 B
sandbox/assets/fetch.js 3.4 KB 1.2 KB 1.4 KB
sandbox/assets/index.js 118.1 KB 33.7 KB (+47 B) 39.7 KB (+2 B)
sandbox/assets/index.css 46.6 KB 7.2 KB 8.1 KB
sandbox/favicon.svg 1.8 KB 1.8 KB 1.8 KB
sandbox/index.html 1.7 KB 581 B (+3 B) 787 B (+1 B)
Total 10.35 MB (-384 B) 5.38 MB (-656 B) (-48%) 5.72 MB (-745 B)

Commit: 3f837f1

@github-actions

github-actions Bot commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

⚡ Performance Report

⚠️ No baseline found on main. This PR's results are recorded but cannot be compared.
Merge to main to establish a baseline.

@lrubasze lrubasze changed the title fix(deps): override esbuild to ^0.28.1 to clear audit advisory CI: esbuild dependency to clear audit advisory test Jun 15, 2026
lrubasze added 2 commits June 15, 2026 22:38
bun audit flagged esbuild >=0.17.0 <0.28.1 (GHSA-gv7w-rqvm-qjhr high,
GHSA-g7r4-m6w7-qqqr low), pulled in transitively via vite and
polkadot-api. Pin the patched release through the existing overrides
block. Build passes across all workspaces.
The setup-playwright action ran 'bunx playwright install' from the repo
root, where playwright is not resolvable, so bunx fetched the latest
(1.61.0) and installed browser build 1228. The Functional/E2E jobs run
'playwright test' from apps/host with the lockfile-pinned 1.60.0, which
needs build 1223 — so every test failed at chromium.launch() with
"Executable doesn't exist". Run the install from apps/host so bunx
resolves the same pinned version and installs the matching build.
@lrubasze lrubasze force-pushed the lrubasze/fix-esbuild-audit branch from 047a4aa to 590e58f Compare June 15, 2026 22:39
@github-actions

Copy link
Copy Markdown
Contributor

⚠️ E2E Product suite skipped — Nova signing bot is unavailable.

This is a Nova-side outage and not a dot.li test failure. Re-run
from the Actions tab once the bot recovers.

Logs: https://github.com/paritytech/dotli-community/actions/runs/27581073672

@lrubasze lrubasze changed the title CI: esbuild dependency to clear audit advisory test fix(ci): clear esbuild audit advisory and pin Playwright browser install Jun 15, 2026
The Functional/E2E Build steps ran 'turbo run build' with no env, so the
host shell was built without VITE_NETWORKS. packages/config/src/network.ts
throws on boot when it's unset, leaving the shell stuck before it mounts
the protocol/app iframes — every test then timed out waiting for the
sandbox iframe. deploy.yml already supplies this from repo vars; give the
test build its own value (paseo-next-v2 first to match the E2E signer
bot's network).
@lrubasze lrubasze changed the title fix(ci): clear esbuild audit advisory and pin Playwright browser install fix(ci): resolve failing CI jobs Jun 15, 2026
@github-actions

Copy link
Copy Markdown
Contributor

E2E Product suite failed on f601b334c8e08246112b65bdf217bbbaff18fff1 — 41 passed, 4 failed, 17 skipped.

Failed tests:

  • Submit
  • In-App
  • Factory
  • Submit

Logs: https://github.com/paritytech/dotli-community/actions/runs/27582324560
Artifacts: e2e-product-results (uploaded above) — open the failed test's trace.zip with npx playwright show-trace.

@leonardocustodio leonardocustodio left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thank you sir, lgtm

@leonardocustodio leonardocustodio merged commit a8f4767 into main Jun 16, 2026
14 of 15 checks passed
@leonardocustodio leonardocustodio deleted the lrubasze/fix-esbuild-audit branch June 16, 2026 17:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants