Repository navigation
ci: smoke den-api native build output (catches unbuilt workspace dist exports) - #3528
Draft
benjaminshafii wants to merge 3 commits into
Draft
benjaminshafii wants to merge 3 commits into
benjaminshafii wants to merge 3 commits into
Conversation
Add a PR/dev job that runs den-api's native build (the Render deploy path, not the Docker image) and then resolves @openwork/types/automations and @openwork/automations under Node's node export condition. Catches workspace exports that point at unbuilt dist/ files, which typecheck and bun/tsx tests cannot see because they resolve the types/bun/development conditions to src.
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
Deploying openwork with
|
| Latest commit: |
c6716fc
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://786bb596.openwork.pages.dev |
| Branch Preview URL: | https://ci-den-api-native-build-smok.openwork.pages.dev |
Contributor
|
Deployment failed for project openwork-diagnostics with the following error: Learn More: https://vercel.com/docs/limits#rate-limits |
Contributor
|
Deployment failed for project openwork-app with the following error: Learn More: https://vercel.com/docs/limits#rate-limits |
Contributor
|
Deployment failed for project openwork-den with the following error: Learn More: https://vercel.com/docs/limits#rate-limits |
Contributor
|
Deployment failed for project openwork-landing with the following error: Learn More: https://vercel.com/docs/limits#rate-limits |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Comment on lines
+45
to
+63
| uses: actions/checkout@v6 | ||
|
|
||
| - name: Setup Node | ||
| uses: actions/setup-node@v6 | ||
| with: | ||
| node-version: 24 | ||
|
|
||
| - name: Setup pnpm | ||
| uses: pnpm/action-setup@v4 | ||
| with: | ||
| version: 11.4.0 | ||
|
|
||
| - name: Get pnpm store path | ||
| id: pnpm-store | ||
| shell: bash | ||
| run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Cache pnpm store | ||
| uses: actions/cache@v5 |
Contributor
There was a problem hiding this comment.
Workflow executes mutable remote action references
Pin the newly added GitHub Actions to full commit SHAs instead of mutable major-version tags so a tag change or compromised release cannot execute attacker-controlled code on the CI runner.
Evidence
- The PR-triggered job runs
actions/checkout@v6,actions/setup-node@v6,pnpm/action-setup@v4, andactions/cache@v5directly from mutable remote tags. - These actions execute before and alongside repository-controlled
pnpm installand build commands on the Blacksmith runner. - A malicious tag update or compromised action release would therefore run code in this newly introduced workflow with the job's GitHub token and runner access.
Identified by Warden · diff-security-review · XYL-7NU
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What / why
#3466 broke prod den-api at boot (
ERR_MODULE_NOT_FOUNDfor@openwork/types/dist/automations.js) while every PR check stayed green:typesexport condition →src/*.tsbun→src/*.tsdevelopment→src/*.tsProd deploys via Render's native build (
scripts/build.mjs), which nothing in CI exercises — and only a plain-Node boot resolves thenodecondition →dist/*.js. This job closes that gap: it runs the native build, then resolves@openwork/types/automationsand@openwork/automationsunder Node'snodecondition from den-api's package context, and assertsdist/main.jsexists.This branch is plain
dev, which still has the live breakage. The failing run here is the demonstration that the backstop catches exactly this failure class. It goes green once #3527 (the prod fix) merges and this branch rebases.Open questions for review (cc @reachjalil)
dist/main.jsagainst a health check (heavier, needs env/DB stubs)?Validation
Workflow-only change (no app runtime):
actionlintpasses (sole warning is the customblacksmith-4vcpu-ubuntu-2204runner label, shared by existing workflows); everyuses:action+version and the runner label are copied verbatim fromci-tests.yml/den-db-check.yml; concurrency follows the repo'scancel-in-progress: trueconvention.