maro
82c4261a81
- Restrict meetingPassword field so it isn't leaked via the public REST/GraphQL API - Fix booking slot computation to use Europe/Berlin time instead of the server's UTC clock - Reset email verification when a customer changes their email address - Fix ICS calendar injection via unescaped carriage returns in event descriptions - Bind WebRTC meeting kicks to a persistent client id so they survive a rejoin - Move the meeting signaling token out of the WebSocket query string into the first message - Prevent duplicate signaling connections from leaking when the same participant reconnects - Use the rightmost X-Forwarded-For entry for rate limiting (single trusted reverse proxy) - Use constant-time comparison for the cron endpoint's bearer token - Remove SVG from allowed Media upload types (stored-XSS risk, unused anyway) - Add baseline security headers and a CSP to next.config.ts - Fix CI/CD script injection via unsanitized git ref names in release.yml
52 lines
1.5 KiB
YAML
52 lines
1.5 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: ['**']
|
|
pull_request:
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: node:22-alpine
|
|
# No live database is needed here — every Payload-backed route in this
|
|
# app is force-dynamic, so `next build` never touches Postgres. These
|
|
# are dummy values only so a real config error (a missing secret) is
|
|
# never silently masked by CI happening to run without one.
|
|
#
|
|
# NODE_ENV is deliberately NOT set here: `npm ci` treats a production
|
|
# NODE_ENV as `--omit=dev`, which would skip eslint/typescript/etc. and
|
|
# break Lint/Typecheck/Test. It's set below, scoped to the Build step.
|
|
env:
|
|
NEXT_TELEMETRY_DISABLED: "1"
|
|
DATABASE_URI: postgresql://ci:ci@localhost:5432/ci
|
|
PAYLOAD_SECRET: ci-only-not-a-real-secret
|
|
MEETING_SESSION_SECRET: ci-only-not-a-real-secret
|
|
ANALYTICS_SALT_SECRET: ci-only-not-a-real-secret
|
|
CRON_SECRET: ci-only-not-a-real-secret
|
|
NEXT_PUBLIC_SERVER_URL: http://localhost:3000
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install build dependencies (sharp needs libc6-compat on alpine)
|
|
run: apk add --no-cache libc6-compat
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Lint
|
|
run: npm run lint
|
|
|
|
- name: Typecheck
|
|
run: npx next typegen && npx tsc --noEmit
|
|
|
|
- name: Test
|
|
run: npm test
|
|
|
|
- name: Build
|
|
env:
|
|
NODE_ENV: production
|
|
run: npm run build
|