2025-10-19 21:35:02 -04:00
|
|
|
/**
|
|
|
|
|
* End-to-end tests using Playwright
|
|
|
|
|
*/
|
|
|
|
|
|
2026-06-19 17:00:57 -04:00
|
|
|
import { test, expect } from '@playwright/test';
|
2025-10-19 21:35:02 -04:00
|
|
|
|
2025-11-01 10:47:02 -04:00
|
|
|
// Helper function for network-resilient page navigation
|
|
|
|
|
async function navigateWithRetry(page: any, url: string, maxRetries = 3): Promise<void> {
|
|
|
|
|
for (let i = 0; i < maxRetries; i++) {
|
|
|
|
|
try {
|
|
|
|
|
await page.goto(url, {
|
feat(ci): enforce runtime-validation image separation (#69)
## Summary
Implements issue #59 by enforcing a hard boundary between CI validation tooling and deployable runtime images.
This PR:
- Adds automated deployable-runtime boundary checks in CI.
- Verifies deployable backend/frontend artifacts are free of CI/development tooling.
- Documents runtime-vs-validation ownership and enforcement behavior.
## What Changed
### CI workflow enforcement
- Updated `.gitea/workflows/docker-build-main.yaml` to:
- Checkout additional verification inputs (`Dockerfile.backend`, `Dockerfile.frontend`, scripts, backend/frontend directories).
- Run `scripts/check-dockerfile-boundaries.sh`.
- Build deployable runtime images (`Dockerfile.backend`, `Dockerfile.frontend --target production`).
- Run `scripts/verify-deployable-image-purity.sh` against both images before publishing CICD image.
- Updated `.gitea/workflows/cicd-checks.yaml` to add:
- `dockerfile-boundary-check` job.
- Boundary validation execution inside the CICD validation image.
### New enforcement scripts
- Added `scripts/check-dockerfile-boundaries.sh`:
- Ensures deployable Dockerfiles do **not** reference CICD image paths (`cicd-base`, `CICD_BASE_IMAGE`, `Dockerfile.cicd*`, etc.).
- Ensures deployable Dockerfiles do **not** include disallowed CI-only tooling tokens.
- Enforces runtime base expectations:
- Backend: `python:3.14-slim`
- Frontend production target: `nginx:alpine`
- Added `scripts/verify-deployable-image-purity.sh`:
- Baseline binary checks for disallowed tooling.
- Backend-specific deep checks:
- Python module import probes for disallowed CI/dev modules.
- `pip show` package metadata checks for disallowed CI/dev packages.
- Frontend-specific deep checks:
- OS package metadata checks (`apk`/`dpkg` when available) for disallowed runtime leaks.
- Directory-based checks for development package trees (`node_modules`, `.venv`, `site-packages`, `dist-packages` in sensitive paths).
## Documentation updates
- Updated `docs/DEVELOPMENT.md`:
- Clarifies runtime-vs-validation enforcement and where checks run.
- Notes purity checks include binaries and metadata artifacts.
- Updated `docs/CICD_MULTI_STAGE_BUILD.md`:
- Adds explicit “Runtime Boundary Enforcement” section.
- Documents metadata-level purity probes.
- Updated `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`:
- Replaces future-only language with current enforcement hooks.
- Documents binary + metadata-level purity enforcement.
## Acceptance Criteria Mapping
1. **Deployable backend/frontend image paths do not require CI-only tool installation**
- Enforced by:
- `scripts/check-dockerfile-boundaries.sh`
- `scripts/verify-deployable-image-purity.sh`
- `docker-build-main.yaml` pre-publish gates
2. **Checks and tests execute in dedicated validation environment(s)**
- Reinforced by:
- `cicd-checks.yaml` boundary-check job running in CICD validation image
- Existing check/test workflow usage of CICD image
3. **Workflow docs identify runtime vs validation concerns**
- Addressed via updates to:
- `docs/DEVELOPMENT.md`
- `docs/CICD_MULTI_STAGE_BUILD.md`
- `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`
## Scope / Non-Goals
- Included:
- Structural separation enforcement
- Workflow-level guardrails
- Documentation clarity and traceability
- Not included:
- Full staging deployment wiring
- Security policy redesign
## Notes for Reviewers
- Main enforcement path is in `docker-build-main.yaml` before CICD image publish.
- New scripts are intentionally fail-fast and policy-oriented.
- Existing deployable Dockerfiles currently satisfy the new gates.
Co-authored-by: copilotcoder <copilotcoder@darkhelm.org>
Reviewed-on: https://dogar.darkhelm.org/DarkHelm.org/plex-playlist/pulls/69
2026-06-22 12:45:20 -04:00
|
|
|
// Vite dev server maintains long-lived connections, so networkidle can flake in CI.
|
|
|
|
|
waitUntil: 'domcontentloaded',
|
2026-06-19 17:00:57 -04:00
|
|
|
timeout: process.env.CI ? 45000 : 30000,
|
|
|
|
|
});
|
|
|
|
|
return; // Success
|
2025-11-01 10:47:02 -04:00
|
|
|
} catch (error) {
|
2026-06-19 17:00:57 -04:00
|
|
|
if (i === maxRetries - 1) throw error; // Last attempt failed
|
|
|
|
|
console.log(`Navigation attempt ${i + 1} failed, retrying...`);
|
|
|
|
|
await page.waitForTimeout(2000); // Wait before retry
|
2025-11-01 10:47:02 -04:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2025-10-19 21:35:02 -04:00
|
|
|
test.describe('Plex Playlist App', () => {
|
|
|
|
|
test('should display app title', async ({ page }) => {
|
2026-06-19 17:00:57 -04:00
|
|
|
await navigateWithRetry(page, '/');
|
2025-10-19 21:35:02 -04:00
|
|
|
|
feat(ci): enforce runtime-validation image separation (#69)
## Summary
Implements issue #59 by enforcing a hard boundary between CI validation tooling and deployable runtime images.
This PR:
- Adds automated deployable-runtime boundary checks in CI.
- Verifies deployable backend/frontend artifacts are free of CI/development tooling.
- Documents runtime-vs-validation ownership and enforcement behavior.
## What Changed
### CI workflow enforcement
- Updated `.gitea/workflows/docker-build-main.yaml` to:
- Checkout additional verification inputs (`Dockerfile.backend`, `Dockerfile.frontend`, scripts, backend/frontend directories).
- Run `scripts/check-dockerfile-boundaries.sh`.
- Build deployable runtime images (`Dockerfile.backend`, `Dockerfile.frontend --target production`).
- Run `scripts/verify-deployable-image-purity.sh` against both images before publishing CICD image.
- Updated `.gitea/workflows/cicd-checks.yaml` to add:
- `dockerfile-boundary-check` job.
- Boundary validation execution inside the CICD validation image.
### New enforcement scripts
- Added `scripts/check-dockerfile-boundaries.sh`:
- Ensures deployable Dockerfiles do **not** reference CICD image paths (`cicd-base`, `CICD_BASE_IMAGE`, `Dockerfile.cicd*`, etc.).
- Ensures deployable Dockerfiles do **not** include disallowed CI-only tooling tokens.
- Enforces runtime base expectations:
- Backend: `python:3.14-slim`
- Frontend production target: `nginx:alpine`
- Added `scripts/verify-deployable-image-purity.sh`:
- Baseline binary checks for disallowed tooling.
- Backend-specific deep checks:
- Python module import probes for disallowed CI/dev modules.
- `pip show` package metadata checks for disallowed CI/dev packages.
- Frontend-specific deep checks:
- OS package metadata checks (`apk`/`dpkg` when available) for disallowed runtime leaks.
- Directory-based checks for development package trees (`node_modules`, `.venv`, `site-packages`, `dist-packages` in sensitive paths).
## Documentation updates
- Updated `docs/DEVELOPMENT.md`:
- Clarifies runtime-vs-validation enforcement and where checks run.
- Notes purity checks include binaries and metadata artifacts.
- Updated `docs/CICD_MULTI_STAGE_BUILD.md`:
- Adds explicit “Runtime Boundary Enforcement” section.
- Documents metadata-level purity probes.
- Updated `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`:
- Replaces future-only language with current enforcement hooks.
- Documents binary + metadata-level purity enforcement.
## Acceptance Criteria Mapping
1. **Deployable backend/frontend image paths do not require CI-only tool installation**
- Enforced by:
- `scripts/check-dockerfile-boundaries.sh`
- `scripts/verify-deployable-image-purity.sh`
- `docker-build-main.yaml` pre-publish gates
2. **Checks and tests execute in dedicated validation environment(s)**
- Reinforced by:
- `cicd-checks.yaml` boundary-check job running in CICD validation image
- Existing check/test workflow usage of CICD image
3. **Workflow docs identify runtime vs validation concerns**
- Addressed via updates to:
- `docs/DEVELOPMENT.md`
- `docs/CICD_MULTI_STAGE_BUILD.md`
- `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`
## Scope / Non-Goals
- Included:
- Structural separation enforcement
- Workflow-level guardrails
- Documentation clarity and traceability
- Not included:
- Full staging deployment wiring
- Security policy redesign
## Notes for Reviewers
- Main enforcement path is in `docker-build-main.yaml` before CICD image publish.
- New scripts are intentionally fail-fast and policy-oriented.
- Existing deployable Dockerfiles currently satisfy the new gates.
Co-authored-by: copilotcoder <copilotcoder@darkhelm.org>
Reviewed-on: https://dogar.darkhelm.org/DarkHelm.org/plex-playlist/pulls/69
2026-06-22 12:45:20 -04:00
|
|
|
await expect(page.getByRole('heading', { level: 1 })).toHaveText('Plex Playlist');
|
2026-06-19 17:00:57 -04:00
|
|
|
});
|
2025-10-19 21:35:02 -04:00
|
|
|
|
|
|
|
|
test('should have welcome message', async ({ page }) => {
|
2026-06-19 17:00:57 -04:00
|
|
|
await navigateWithRetry(page, '/');
|
2025-10-19 21:35:02 -04:00
|
|
|
|
feat(ci): enforce runtime-validation image separation (#69)
## Summary
Implements issue #59 by enforcing a hard boundary between CI validation tooling and deployable runtime images.
This PR:
- Adds automated deployable-runtime boundary checks in CI.
- Verifies deployable backend/frontend artifacts are free of CI/development tooling.
- Documents runtime-vs-validation ownership and enforcement behavior.
## What Changed
### CI workflow enforcement
- Updated `.gitea/workflows/docker-build-main.yaml` to:
- Checkout additional verification inputs (`Dockerfile.backend`, `Dockerfile.frontend`, scripts, backend/frontend directories).
- Run `scripts/check-dockerfile-boundaries.sh`.
- Build deployable runtime images (`Dockerfile.backend`, `Dockerfile.frontend --target production`).
- Run `scripts/verify-deployable-image-purity.sh` against both images before publishing CICD image.
- Updated `.gitea/workflows/cicd-checks.yaml` to add:
- `dockerfile-boundary-check` job.
- Boundary validation execution inside the CICD validation image.
### New enforcement scripts
- Added `scripts/check-dockerfile-boundaries.sh`:
- Ensures deployable Dockerfiles do **not** reference CICD image paths (`cicd-base`, `CICD_BASE_IMAGE`, `Dockerfile.cicd*`, etc.).
- Ensures deployable Dockerfiles do **not** include disallowed CI-only tooling tokens.
- Enforces runtime base expectations:
- Backend: `python:3.14-slim`
- Frontend production target: `nginx:alpine`
- Added `scripts/verify-deployable-image-purity.sh`:
- Baseline binary checks for disallowed tooling.
- Backend-specific deep checks:
- Python module import probes for disallowed CI/dev modules.
- `pip show` package metadata checks for disallowed CI/dev packages.
- Frontend-specific deep checks:
- OS package metadata checks (`apk`/`dpkg` when available) for disallowed runtime leaks.
- Directory-based checks for development package trees (`node_modules`, `.venv`, `site-packages`, `dist-packages` in sensitive paths).
## Documentation updates
- Updated `docs/DEVELOPMENT.md`:
- Clarifies runtime-vs-validation enforcement and where checks run.
- Notes purity checks include binaries and metadata artifacts.
- Updated `docs/CICD_MULTI_STAGE_BUILD.md`:
- Adds explicit “Runtime Boundary Enforcement” section.
- Documents metadata-level purity probes.
- Updated `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`:
- Replaces future-only language with current enforcement hooks.
- Documents binary + metadata-level purity enforcement.
## Acceptance Criteria Mapping
1. **Deployable backend/frontend image paths do not require CI-only tool installation**
- Enforced by:
- `scripts/check-dockerfile-boundaries.sh`
- `scripts/verify-deployable-image-purity.sh`
- `docker-build-main.yaml` pre-publish gates
2. **Checks and tests execute in dedicated validation environment(s)**
- Reinforced by:
- `cicd-checks.yaml` boundary-check job running in CICD validation image
- Existing check/test workflow usage of CICD image
3. **Workflow docs identify runtime vs validation concerns**
- Addressed via updates to:
- `docs/DEVELOPMENT.md`
- `docs/CICD_MULTI_STAGE_BUILD.md`
- `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`
## Scope / Non-Goals
- Included:
- Structural separation enforcement
- Workflow-level guardrails
- Documentation clarity and traceability
- Not included:
- Full staging deployment wiring
- Security policy redesign
## Notes for Reviewers
- Main enforcement path is in `docker-build-main.yaml` before CICD image publish.
- New scripts are intentionally fail-fast and policy-oriented.
- Existing deployable Dockerfiles currently satisfy the new gates.
Co-authored-by: copilotcoder <copilotcoder@darkhelm.org>
Reviewed-on: https://dogar.darkhelm.org/DarkHelm.org/plex-playlist/pulls/69
2026-06-22 12:45:20 -04:00
|
|
|
await expect(page.getByText('Welcome to the Plex Playlist Manager')).toBeVisible();
|
2026-06-19 17:00:57 -04:00
|
|
|
});
|
2025-10-19 21:35:02 -04:00
|
|
|
|
|
|
|
|
test('should load without errors', async ({ page }) => {
|
2026-06-19 17:00:57 -04:00
|
|
|
const errors: string[] = [];
|
2025-10-19 21:35:02 -04:00
|
|
|
page.on('console', (msg) => {
|
|
|
|
|
if (msg.type() === 'error') {
|
2025-11-01 10:47:02 -04:00
|
|
|
// Filter out network-related errors that are acceptable in CI
|
2026-06-19 17:00:57 -04:00
|
|
|
const errorText = msg.text();
|
2025-11-01 10:47:02 -04:00
|
|
|
if (!errorText.includes('net::') && !errorText.includes('Failed to fetch')) {
|
2026-06-19 17:00:57 -04:00
|
|
|
errors.push(errorText);
|
2025-11-01 10:47:02 -04:00
|
|
|
}
|
2025-10-19 21:35:02 -04:00
|
|
|
}
|
2026-06-19 17:00:57 -04:00
|
|
|
});
|
2025-10-19 21:35:02 -04:00
|
|
|
|
2026-06-19 17:00:57 -04:00
|
|
|
await navigateWithRetry(page, '/');
|
2025-10-19 21:35:02 -04:00
|
|
|
|
feat(ci): enforce runtime-validation image separation (#69)
## Summary
Implements issue #59 by enforcing a hard boundary between CI validation tooling and deployable runtime images.
This PR:
- Adds automated deployable-runtime boundary checks in CI.
- Verifies deployable backend/frontend artifacts are free of CI/development tooling.
- Documents runtime-vs-validation ownership and enforcement behavior.
## What Changed
### CI workflow enforcement
- Updated `.gitea/workflows/docker-build-main.yaml` to:
- Checkout additional verification inputs (`Dockerfile.backend`, `Dockerfile.frontend`, scripts, backend/frontend directories).
- Run `scripts/check-dockerfile-boundaries.sh`.
- Build deployable runtime images (`Dockerfile.backend`, `Dockerfile.frontend --target production`).
- Run `scripts/verify-deployable-image-purity.sh` against both images before publishing CICD image.
- Updated `.gitea/workflows/cicd-checks.yaml` to add:
- `dockerfile-boundary-check` job.
- Boundary validation execution inside the CICD validation image.
### New enforcement scripts
- Added `scripts/check-dockerfile-boundaries.sh`:
- Ensures deployable Dockerfiles do **not** reference CICD image paths (`cicd-base`, `CICD_BASE_IMAGE`, `Dockerfile.cicd*`, etc.).
- Ensures deployable Dockerfiles do **not** include disallowed CI-only tooling tokens.
- Enforces runtime base expectations:
- Backend: `python:3.14-slim`
- Frontend production target: `nginx:alpine`
- Added `scripts/verify-deployable-image-purity.sh`:
- Baseline binary checks for disallowed tooling.
- Backend-specific deep checks:
- Python module import probes for disallowed CI/dev modules.
- `pip show` package metadata checks for disallowed CI/dev packages.
- Frontend-specific deep checks:
- OS package metadata checks (`apk`/`dpkg` when available) for disallowed runtime leaks.
- Directory-based checks for development package trees (`node_modules`, `.venv`, `site-packages`, `dist-packages` in sensitive paths).
## Documentation updates
- Updated `docs/DEVELOPMENT.md`:
- Clarifies runtime-vs-validation enforcement and where checks run.
- Notes purity checks include binaries and metadata artifacts.
- Updated `docs/CICD_MULTI_STAGE_BUILD.md`:
- Adds explicit “Runtime Boundary Enforcement” section.
- Documents metadata-level purity probes.
- Updated `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`:
- Replaces future-only language with current enforcement hooks.
- Documents binary + metadata-level purity enforcement.
## Acceptance Criteria Mapping
1. **Deployable backend/frontend image paths do not require CI-only tool installation**
- Enforced by:
- `scripts/check-dockerfile-boundaries.sh`
- `scripts/verify-deployable-image-purity.sh`
- `docker-build-main.yaml` pre-publish gates
2. **Checks and tests execute in dedicated validation environment(s)**
- Reinforced by:
- `cicd-checks.yaml` boundary-check job running in CICD validation image
- Existing check/test workflow usage of CICD image
3. **Workflow docs identify runtime vs validation concerns**
- Addressed via updates to:
- `docs/DEVELOPMENT.md`
- `docs/CICD_MULTI_STAGE_BUILD.md`
- `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`
## Scope / Non-Goals
- Included:
- Structural separation enforcement
- Workflow-level guardrails
- Documentation clarity and traceability
- Not included:
- Full staging deployment wiring
- Security policy redesign
## Notes for Reviewers
- Main enforcement path is in `docker-build-main.yaml` before CICD image publish.
- New scripts are intentionally fail-fast and policy-oriented.
- Existing deployable Dockerfiles currently satisfy the new gates.
Co-authored-by: copilotcoder <copilotcoder@darkhelm.org>
Reviewed-on: https://dogar.darkhelm.org/DarkHelm.org/plex-playlist/pulls/69
2026-06-22 12:45:20 -04:00
|
|
|
// Ensure document and app shell are loaded before checking browser errors.
|
|
|
|
|
await page.waitForLoadState('domcontentloaded');
|
|
|
|
|
await expect(page.getByRole('heading', { level: 1 })).toBeVisible();
|
2025-10-19 21:35:02 -04:00
|
|
|
|
2025-11-01 10:47:02 -04:00
|
|
|
// Give extra time for any async operations in unstable networks
|
2026-06-19 17:00:57 -04:00
|
|
|
await page.waitForTimeout(process.env.CI ? 3000 : 1000);
|
2025-11-01 10:47:02 -04:00
|
|
|
|
2026-06-19 17:00:57 -04:00
|
|
|
expect(errors).toHaveLength(0);
|
|
|
|
|
});
|
|
|
|
|
});
|