2GT-RichandClaude Opus 5
273a0da737
Closes #121. The Quick Deploy file was missing NETFLOW_BIND_PORT and the 2055/udp mapping, so the collector bound inside the container and nothing reached it. NetFlow did nothing, silently, with an empty traffic page and no error — for everyone following the path the README tells new users to take. The report was accurate and understated. docker-compose.ghcr.yml had drifted for seven weeks, and three closed issues had never reached it: * NETFLOW_BIND_PORT and the UDP port — as reported * all five POLLER_* tunables — #114, whose fix was "pass the tunables through" * the Redis memory ceiling and eviction policy — #116 * TZ on the postgres service, which nobody had noticed at all The middle one is the uncomfortable part. Four days ago #114 was closed by forwarding poller settings that were documented but inert, with a comment saying setting them "did precisely nothing". On Quick Deploy that remained true, because one compose file was fixed and the other was not — including the advice given to that reporter about which knob to turn. So patching the four gaps would have been treating the symptom. The two files describe the same system and differ only in where images come from; maintaining both by hand meant remembering every change twice, and the one forgotten was always the file no maintainer runs. docker-compose.ghcr.yml is now generated from docker-compose.yml by scripts/generate-ghcr-compose.mjs, which performs the two build-to-image swaps and nothing else. Substitution is textual rather than parse-and-reserialise so comments survive — the reasoning about Redis eviction is worth more than the two lines it explains. The file stays committed and browsable, because the README tells people to curl it directly. A --check mode runs as the first preflight gate and as its own CI job, both of which fail when the committed file does not match what the generator produces. Verified by deleting the NetFlow line and watching the guard reject it, with the reason and the fix in the failure message. Reported by @mamb1329, on their first issue. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
111 lines
2.9 KiB
YAML
111 lines
2.9 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
# Cheap, and guards a file no maintainer runs. The published deployment file is
|
|
# generated from docker-compose.yml; when they were maintained separately the
|
|
# published one silently lost the NetFlow port, every poller tunable and the
|
|
# Redis memory ceiling, and it took an outside report to notice (#121).
|
|
compose:
|
|
name: Deployment files in sync
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: actions/setup-node@v7
|
|
with:
|
|
node-version: '20'
|
|
- name: Check docker-compose.ghcr.yml is current
|
|
run: node scripts/generate-ghcr-compose.mjs --check
|
|
|
|
frontend:
|
|
name: Frontend — Lint, Type-check & Build
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: frontend
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
cache-dependency-path: frontend/package-lock.json
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Lint
|
|
run: npm run lint
|
|
|
|
- name: Type-check
|
|
run: npx tsc --noEmit
|
|
|
|
- name: Build
|
|
run: npm run build
|
|
|
|
backend:
|
|
name: Backend — Lint, Type-check & Build
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: backend
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
cache-dependency-path: backend/package-lock.json
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Lint
|
|
run: npm run lint
|
|
|
|
- name: Type-check
|
|
run: npx tsc --noEmit
|
|
|
|
- name: Build
|
|
run: npm run build
|
|
|
|
audit:
|
|
name: Security Audit
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: '20'
|
|
|
|
# Audit production dependencies only (dev/build tooling isn't in the shipped
|
|
# image: the backend installs with --omit=dev and the frontend ships a static
|
|
# build). audit-ci lets us fail on high+ prod advisories while allowlisting
|
|
# ones that don't apply.
|
|
#
|
|
# Allowlisted:
|
|
# GHSA-qwww-vcr4-c8h2 — React Router "RSC Mode CSRF Bypass". This is a
|
|
# client-side SPA (BrowserRouter); we don't use RSC mode, and there is no
|
|
# forward-compatible fix for react-router-dom 7.x (only a downgrade).
|
|
- name: Audit frontend dependencies
|
|
run: npx --yes audit-ci@^7 --high --skip-dev --allowlist GHSA-qwww-vcr4-c8h2
|
|
working-directory: frontend
|
|
|
|
- name: Audit backend dependencies
|
|
run: npx --yes audit-ci@^7 --high --skip-dev
|
|
working-directory: backend
|