109 lines
3.6 KiB
YAML
109 lines
3.6 KiB
YAML
name: CI Verification
|
|
|
|
on:
|
|
push:
|
|
branches: [ main ]
|
|
pull_request:
|
|
branches: [ main ]
|
|
|
|
jobs:
|
|
verify:
|
|
name: Lint & Extension Integrity Check
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
|
|
- name: Validate manifest.json
|
|
run: |
|
|
echo "🔍 Validating manifest.json syntax and schema..."
|
|
node -e "
|
|
const manifest = JSON.parse(require('fs').readFileSync('manifest.json', 'utf8'));
|
|
if (manifest.manifest_version !== 3) {
|
|
console.error('Error: Manifest version must be 3');
|
|
process.exit(1);
|
|
}
|
|
console.log('✅ manifest.json is valid (v' + manifest.version + ')');
|
|
"
|
|
|
|
- name: Verify Referenced Assets & Files
|
|
run: |
|
|
echo "🔍 Checking that all files referenced in manifest.json exist..."
|
|
node -e "
|
|
const fs = require('fs');
|
|
const manifest = JSON.parse(fs.readFileSync('manifest.json', 'utf8'));
|
|
const files = [
|
|
manifest.background?.service_worker,
|
|
manifest.action?.default_popup,
|
|
...(manifest.content_scripts?.flatMap(cs => cs.js) || []),
|
|
...Object.values(manifest.icons || {})
|
|
].filter(Boolean);
|
|
|
|
let missing = 0;
|
|
for (const file of files) {
|
|
if (!fs.existsSync(file)) {
|
|
console.error('❌ Missing file referenced in manifest:', file);
|
|
missing++;
|
|
} else {
|
|
console.log(' ✓ Found:', file);
|
|
}
|
|
}
|
|
if (missing > 0) process.exit(1);
|
|
console.log('✅ All manifest files exist!');
|
|
"
|
|
|
|
- name: JavaScript Syntax Check
|
|
run: |
|
|
echo "🔍 Checking JavaScript syntax..."
|
|
find scripts dashboard popup -name "*.js" | while read -r jsfile; do
|
|
node --check "$jsfile"
|
|
echo " ✓ Syntax valid: $jsfile"
|
|
done
|
|
echo "✅ All JavaScript files passed syntax verification!"
|
|
|
|
- name: Run Anti-Data-Leak Audit
|
|
run: |
|
|
echo "🔍 Checking repository for sensitive paths and keys..."
|
|
ERRORS=0
|
|
|
|
# Check for forbidden export data or test archives
|
|
if find . -name "*.zip" -o -name "activities.csv" -o -name "activities.json" | grep -v ".git" | grep -q .; then
|
|
echo "❌ Forbidden data/archive file found in repository!"
|
|
ERRORS=$((ERRORS + 1))
|
|
fi
|
|
|
|
# Check for hardcoded local machine paths
|
|
if grep -rEn "(/Users/|/home/)[a-zA-Z0-9_\.-]+" --exclude-dir=".git" --exclude-dir=".githooks" --exclude="*.log" .; then
|
|
echo "❌ Hardcoded local path detected in source code!"
|
|
ERRORS=$((ERRORS + 1))
|
|
fi
|
|
|
|
if [ "$ERRORS" -gt 0 ]; then
|
|
echo "🚨 CI Audit failed with $ERRORS issue(s)."
|
|
exit 1
|
|
fi
|
|
echo "✅ Security & data leak check passed!"
|
|
|
|
- name: Test Package Build
|
|
run: |
|
|
echo "📦 Building test extension package..."
|
|
zip -r brightwheel-exporter-test.zip . \
|
|
-x "*.git*" \
|
|
-x ".githooks/*" \
|
|
-x ".github/*" \
|
|
-x "emmy/*" \
|
|
-x "exports/*" \
|
|
-x "data/*" \
|
|
-x "*.md" \
|
|
-x "LICENSE" \
|
|
-x "brightwheel-exporter-test.zip"
|
|
|
|
echo "✅ Package built successfully:"
|
|
unzip -l brightwheel-exporter-test.zip
|