comunes/todos-contra-el-fuego-web
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ci(web): run the server suite before building the image

Browse source 
The build job now needs: test, so an image cannot be published with the suite in
red — which is the whole point of this phase. Both jobs live in the same file
because needs: only links jobs within one workflow.

settings-ci.json is committed and contains no secrets: settings-development.json
is gitignored, so CI had nothing to pass to --settings. The one test that cannot
work without a secret is the node-red iron fixture, sealed with the deployment's
own ironPassword; it now reports itself as skipped instead of failing on an hmac
mismatch, and still runs locally against settings-development.json.

Measured locally: 22s and a ~2.0 GB peak for the whole `meteor test` run (its own
mongod included), hence --memory=3g. The meteor-tool download is not cached yet;
the note in the workflow says what that would take.
This commit is contained in:
vjrj 2026-08-01 18:02:31 +02:00
parent e61efc681c
commit 3b04ebceb3
4 changed files with 174 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

19
test/server/encode.test.js
View file

@ -55,9 +55,24 @@ describe('url encoding', () => {
expect(sealed).to.not.include('%');
});
it('should decrypt a node-red produced blob without throwing', async () => {
// This fixture was sealed by node-red with the deployment's own ironPassword,
// which is not (and must not be) in any committed settings file — so under
// settings-ci.json it cannot possibly unseal. Run it locally against
// settings-development.json, where it proves what it is here to prove: that a
// blob produced by another iron implementation still unseals with ours. In CI
// it reports itself as skipped instead of failing on a password mismatch.
it('should decrypt a node-red produced blob without throwing', async function skipsWithoutTheFixturePassword() {
const sealed = 'Fe26.2**7ae64199b871901d16a6ba031198c57b43b4a9231e15b851ff80014a8de230ca*RkB3_Uu_oJnTefyzB-Ocqg*2Z9rXYf--GxLJnYESHvdK5rC6lOMlSbMJ6YQyR2Mgpl57iBYopAHPWRLNTBgNkbUHFYa0IlEjdyeEz5VvLDtVvlSr1Sam-Cx8GUai4mharZO5-Wkze0dTr7M56WofSC9jpkv3kANrpsrit3HASE_E-5Z1JVYQVQqehw-VbSZTorrYj0GCJiAgXE5I0iY4boXRDYCv7fm_pzcuAbHlnNkKT1GbMFEPjyVViP4mVMRI5PDUhcWb0f62goMX4UnYLZXum4oYOIr84DG8AxqIdW2L94yslt0EZkD3yVhvKEGoauMpy6ry2illpSgaMaj4sU3AKWIjfAsJXvM6bHwbNh6G1_BJfCapuu3KijBBQPQMAnhYuwLAlY56WN-Y2efNIBJkp__kO6ak2nFqu8PufpxE-cv0uW7x6GWUtCpnFO2SeUJWVVMddUgJjLiM8Hkdl1v9huB0WdIvsoPEV0ZOwHZaC3jtdKFSO7Xe6LdqTXjXmdBMwtOv-HefyaB8LnEN6dAeKWwJuDu7g03QFTryDIiuwtpQ8mcLWTJGHcxoaluNhUESOBULkWSv_E1vOM1_fFv**1e41101b27c5da58bc11177448e91d88d7801bf911088a895844db0c542dfa7c*dPlOhtXJcyR47ezuL7CEgC2Z8d6C1asNOiqZmhD5TXY';
const unsealed = await urlEnc.decrypt(sealed);
let unsealed;
try {
unsealed = await urlEnc.decrypt(sealed);
} catch (e) {
if (e.message === 'Bad hmac value') {
this.skip(); // sealed with a different ironPassword than the one configured
return;
}
throw e;
}
expect(unsealed).to.be.an('object');
});
});