docs: point at the relay replication matrix as the real verification … #155

Workflow file for this run

	name: CI

	on:
	push:
	branches: ['**']
	pull_request:
	branches: [main, develop]
	release:
	types: [created]
	# Lets release.yml reuse this job instead of duplicating the pipeline.
	workflow_call:

	jobs:
	test:
	name: Run Tests
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v7

	- name: Setup pnpm
	uses: pnpm/action-setup@v6
	with:
	version: 10

	- name: Setup Node.js 22.x
	uses: actions/setup-node@v6
	with:
	node-version: '22.x'
	cache: 'pnpm'

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	- name: Run lint
	run: pnpm run lint

	- name: Check formatting
	run: pnpm run format:check

	- name: Install Playwright browsers
	run: pnpm exec playwright install --with-deps chromium

	- name: Install demo dependencies (webauthn-todo-demo)
	run: \|
	cd examples/webauthn-todo-demo
	pnpm install --frozen-lockfile

	- name: Build demo application (webauthn-todo-demo)
	run: \|
	cd examples/webauthn-todo-demo
	pnpm run build

	- name: Install demo dependencies (ed25519-encrypted-keystore-demo)
	run: \|
	cd examples/ed25519-encrypted-keystore-demo
	pnpm install --frozen-lockfile

	- name: Install demo dependencies (webauthn-varsig-demo)
	run: \|
	cd examples/webauthn-varsig-demo
	pnpm install --frozen-lockfile

	- name: Build demo application (ed25519-encrypted-keystore-demo)
	run: \|
	cd examples/ed25519-encrypted-keystore-demo
	pnpm run build

	- name: Build demo application (webauthn-varsig-demo)
	run: \|
	cd examples/webauthn-varsig-demo
	pnpm run build

	- name: Run WebAuthn focused tests
	run: pnpm exec playwright test tests/webauthn-focused.test.js --project=chromium --reporter=github
	env:
	CI: true

	- name: Run WebAuthn logging E2E tests
	run: pnpm run test:logging
	env:
	CI: true

	- name: Run WebAuthn integration tests
	run: pnpm exec playwright test tests/webauthn-integration.test.js --project=chromium --reporter=github
	env:
	CI: true

	- name: Run WebAuthn varsig E2E tests
	run: pnpm run test:varsig-e2e
	env:
	CI: true

	- name: Run encrypted keystore tests
	run: pnpm exec playwright test tests/encrypted-keystore.test.js --project=chromium --reporter=github
	env:
	CI: true
	USE_ENCRYPTED_DEMO: true

	- name: Run Ed25519 Encrypted Keystore E2E tests
	run: USE_ENCRYPTED_DEMO=true pnpm exec playwright test tests/ed25519-encrypted-keystore-e2e.test.js --project=chromium --reporter=github
	env:
	CI: true

	- name: Run two-peer replication tests
	run: pnpm run test:two-peer
	env:
	CI: true

	- name: Run WebAuthn attestation parsing tests
	run: pnpm exec playwright test tests/webauthn-attestation-parsing.test.js --project=chromium --reporter=github
	env:
	CI: true

	- name: Run WebAuthn unit tests
	# This suite imports src/index.js through Vite's /@fs endpoint, which
	# only the dev server exposes. playwright.config.js starts `preview`
	# when CI is set, and that build has no such route, so this step has to
	# run against the dev server — hence the cleared CI variable.
	run: pnpm exec playwright test tests/webauthn-unit.test.js --project=chromium --reporter=github
	env:
	CI: ''

	- name: Run WebAuthn verification tests
	run: pnpm exec playwright test tests/webauthn-verification.test.js --project=chromium --reporter=github
	env:
	CI: true

	- name: Run standalone toolkit tests
	run: pnpm exec playwright test tests/standalone-toolkit.test.js --project=chromium --reporter=github
	env:
	CI: true

	- name: Run Ed25519 keystore DID tests
	run: pnpm exec playwright test tests/ed25519-keystore-did.test.js --project=chromium --reporter=github
	env:
	CI: true
	USE_ENCRYPTED_DEMO: true

	- name: Run simple encryption integration tests
	run: pnpm exec playwright test tests/simple-encryption-integration.test.js --project=chromium --reporter=github
	env:
	CI: true
	USE_ENCRYPTED_DEMO: true

	- name: Upload test artifacts
	if: failure()
	uses: actions/upload-artifact@v7
	with:
	name: playwright-results-node-22
	path: \|
	test-results/
	playwright-report/
	retention-days: 7

	security-audit:
	name: Security Audit
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v7

	- name: Setup pnpm
	uses: pnpm/action-setup@v6
	with:
	version: 10

	- name: Setup Node.js 22.x
	uses: actions/setup-node@v6
	with:
	node-version: '22.x'
	cache: 'pnpm'

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	# Informational, and deliberately not `continue-on-error`. That keeps the
	# job green but still records a red "Process completed with exit code 1"
	# annotation on the run, which reads like a failure the job is hiding.
	# Swallowing the status instead means the counts land in the summary and
	# nothing is annotated as an error.
	#
	# Why informational: the dev tree pulls helia and libp2p, worth ~86
	# advisories this package cannot act on. Even --prod reports 5, all via
	# iso-web > iso-kv > conf > ajv. The enforced floor below is therefore
	# `critical`; tighten it to high, then moderate, as that chain clears.
	- name: Audit (report)
	run: \|
	{
	echo "### Dependency audit"
	echo
	for scope in "full tree:" "production only:--prod"; do
	label="${scope%%:}"; flag="${scope#:}"
	echo "<details><summary>$label</summary>"
	echo
	echo '```'
	pnpm audit $flag --audit-level=moderate 2>&1 \| tail -5 \|\| true
	echo '```'
	echo
	echo "</details>"
	echo
	done
	} >> "$GITHUB_STEP_SUMMARY"

	# What consumers actually install, and it is now clean. The floor used to
	# be `critical` because iso-web > iso-kv > conf > ajv dragged in five
	# advisories that could not be acted on from here; overriding ajv and
	# fast-uri resolves that chain, so this can enforce at moderate.
	#
	# The full tree still reports ~80 from the helia and libp2p dev
	# dependencies, which is why only --prod is a gate.
	- name: Audit production dependencies (enforced at moderate)
	run: pnpm audit --prod --audit-level=moderate

	package-validation:
	name: Package Validation
	runs-on: ubuntu-latest
	needs: [test]

	steps:
	- name: Checkout code
	uses: actions/checkout@v7

	- name: Setup pnpm
	uses: pnpm/action-setup@v6
	with:
	version: 10

	- name: Setup Node.js 22.x
	uses: actions/setup-node@v6
	with:
	node-version: '22.x'
	cache: 'pnpm'

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	- name: Package contents
	run: pnpm pack --pack-destination /tmp/pkg

	- name: Declared entry points are in the tarball
	run: \|
	cd /tmp/pkg
	tar tzf *.tgz > files.txt
	for f in package/src/index.js package/verification.js \
	package/src/standalone/index.js package/src/keystore/index.js \
	package/types/index.d.ts; do
	grep -qx "$f" files.txt \|\| { echo "::error::$f missing from tarball"; exit 1; }
	done
	echo "all declared entry points present"

	- name: Install the tarball and import its exports
	# The root export is not imported here: it pulls the @orbitdb/core peer
	# dependency, and @orbitdb/core@4.0.0 uses it-drain without declaring
	# it, so a bare install of that tree fails for reasons unrelated to this
	# package. The subpath exports cover the exports map and the published
	# files, which is what this job is for.
	run: \|
	mkdir -p /tmp/pkgtest && cd /tmp/pkgtest
	npm init -y > /dev/null
	npm install /tmp/pkg/*.tgz
	for sub in standalone keystore verification; do
	node --input-type=module -e "
	const m = await import('@le-space/orbitdb-identity-provider-webauthn-did/$sub');
	const n = Object.keys(m).length;
	if (n === 0) { console.error('::error::./$sub exported nothing'); process.exit(1); }
	console.log('./$sub — ' + n + ' exports');
	"
	done

Navigation Menu

Uh oh!

Uh oh!

docs: point at the relay replication matrix as the real verification … #155

Workflow file

docs: point at the relay replication matrix as the real verification … #155

Uh oh!

Workflow file for this run