CodeQL flagged the workflow for running with default GITHUB_TOKEN
permissions. None of the jobs need write scopes, so pin to the
minimum to contain blast radius if a third-party action is
compromised.
Replace the per-shard \`yarn dev\` with a single static build
job whose output is shared as an artifact and served by stock
nginx using the production vhost. Cuts e2e startup cost and
exercises the same bundle we ship.
Key the Playwright browser cache by the installed @playwright/test
version instead of yarn.lock so cache hits actually match the binaries
Playwright expects, avoiding redundant browser downloads on every CI
run. On cache hit we still install system deps to keep headless runs
working.
E2e tests take 20-23min per browser because they run sequentially
on a single runner with no browser caching. Shard tests across 3
parallel runners per browser and cache Playwright browser binaries
to reduce wall-clock time to ~7min per browser.
We use the Docker Hub Workflow to build and push
our images to Docker Hub, but to check if we
have vulnerabilities in our images as well.
When we are just checking for vulnerabilities,
we don't need to do all the builing steps.
This commit optimizes the workflow by only doing the
necessary steps when we are just checking for
vulnerabilities, so during pull requests we skip the build
steps, and we do not activate QEMU and buildx
The e2e tests in drive-frontend.yml need the compiled mail
templates. Rather than duplicating the build-mails job, we
extract it into a reusable workflow that both drive.yml and
drive-frontend.yml can call.
There is a delay between the time the signature is issued and the
time it is checked. Although this delay is minimal, if the signature
is issued at the end of a second, both timestamps can differ of 1s.
Recently a CVE present in a dependency of setuptool is blocking our CI.
The CVE is fixed, a new release of the dependency (jaraco.context) is
made but the setuptool project is not updating it. We already migrate
from pip to uv to manage our dependencies. We can also migrate the build
backend from setuptool to uv_build.
In the pyproject file, the readme property has been removed, because
uv_build try to read it, but the readme is at the root of the project
and not copied into the Dockerfile instructions. This readme can be used
when the package is published on pypi but it is not the case for Drive.
We want to allow instance to not setup email sending without causing
crashes. Also add the envvar to the test setup so that the existing
tests that were running without DJANGO_EMAIL_HOST to None still
work.
Migreate usage of pip to uv in github actions. How python is setup is
also changed. Doing like this, we will just have to upgrade the python
version requirement in the pyproject file
Before the playwright browsers were installing the most
up-to-date version, not the version of the repository.
This was causing sometimes mismatch and ci crashes when
playwright releases a new version.
git-lint steps are independant and we would like to have all checks at
once. Using the `if: always()` instruction should ensure all steps
should be run event if the previous fails.
Replace custom Docker Hub authentication with standard, secure,
official GitHub actions for improved security and maintainability.
Uses officially supported actions that follow security best practices
and receive regular updates from GitHub.
Avoid unsecure handling of GitHub secrets.
The setup-python action is able to cache the dependencies and reuse this
cache while the pyproject file has not changed. It is easy to setup,
juste the package manager used has to be declared in the cache settings.
Nathan Vasse