feat(settings): read Node Display settings per-source (#4412 Phase 2) #8656

Workflow file for this run

	name: CI

	on:
	push:
	branches: [ main, develop ]
	pull_request:
	# Deliberately NOT filtered by target branch. The retired pr-tests.yml ran on
	# PRs into any branch; this workflow used to be limited to main/develop, so
	# narrowing it here would silently leave PRs targeting release/feature
	# branches with no test run at all.
	types: [ opened, synchronize, reopened ]

	# Inherited from the retired pr-tests.yml: without this, every push to a PR
	# branch starts a full run and the superseded ones keep burning runners to
	# completion.
	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: true

	jobs:
	test:
	name: Test Suite
	runs-on: ubuntu-latest

	services:
	postgres:
	image: postgres:16
	env:
	POSTGRES_USER: test
	POSTGRES_PASSWORD: test
	POSTGRES_DB: meshmonitor_test
	ports:
	- 5433:5432
	options: >-
	--health-cmd pg_isready
	--health-interval 10s
	--health-timeout 5s
	--health-retries 5
	mysql:
	image: mysql:8
	env:
	MYSQL_ROOT_PASSWORD: root
	MYSQL_USER: test
	MYSQL_PASSWORD: test
	MYSQL_DATABASE: meshmonitor_test
	ports:
	- 3307:3306
	options: >-
	--health-cmd "mysqladmin ping -h localhost"
	--health-interval 10s
	--health-timeout 5s
	--health-retries 5

	strategy:
	matrix:
	# Node 20 dropped: nothing we ship runs it. The main image is Node 24,
	# the LXC template is NodeSource 24, and armv7 — the lowest target — is
	# Node 22 (Dockerfile.armv7 pins 22 because Node 24 has no ARMv7 build).
	# 20.x was test-only, and the ecosystem has moved past it: node-gyp 13
	# and its bundled undici require >=22, so a native rebuild of
	# better-sqlite3 now fails outright on Node 20.
	node-version: [22.x, 24.x, 25.x]

	steps:
	- name: Checkout code
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	with:
	submodules: recursive # Initialize protobufs submodule for tests

	- name: Setup Node.js ${{ matrix.node-version }}
	uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
	with:
	node-version: ${{ matrix.node-version }}
	cache: 'npm'

	- name: Cache dependencies
	uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
	with:
	path: ~/.npm
	key: ${{ runner.os }}-node-${{ matrix.node-version }}-${{ hashFiles('**/package-lock.json') }}
	restore-keys: \|
	${{ runner.os }}-node-${{ matrix.node-version }}-
	${{ runner.os }}-node-

	- name: Install dependencies
	run: npm install --legacy-peer-deps

	- name: Run lint ratchet
	# BLOCKING: fails only on new violations above the checked-in baseline.
	# Existing debt is frozen in eslint-baseline.json and burns down over time.
	# Regenerate baseline: npm run lint:baseline. Tracking: #3962 Task 1.4.
	run: npm run lint:ci

	- name: Run type checking
	run: npm run typecheck

	# Test-file type check runs on ONE Node version (non-blocking; tracks
	# toward a clean tsconfig.tests). Coverage generation + Codecov upload were
	# removed (#4172): they ran on a single leg, produced no enforced signal
	# (no token, no thresholds, no PR status check, no badge — Codecov was
	# already fail_ci_if_error:false), and @vitest/coverage-v8 hung for 30+ min
	# on Node 24, repeatedly blocking merges. `npm run test:coverage` remains
	# available for ad-hoc local reports.
	- name: Type-check tests (non-blocking)
	if: matrix.node-version == '24.x'
	run: npm run typecheck:tests
	# NON-BLOCKING: ~283 pre-existing test-type errors (mock/signature drift).
	# Flip to blocking (remove continue-on-error) once `npm run typecheck:tests` is clean (0 errors).
	# Tracking: remediation epic #3962 Task 1.2.
	continue-on-error: true

	- name: Run tests
	run: npm run test:run

	build:
	name: Build Check
	runs-on: ubuntu-latest
	needs: test

	steps:
	- name: Checkout code
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	with:
	submodules: recursive # Initialize protobufs submodule

	- name: Setup Node.js
	uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
	with:
	node-version: '24.x'
	cache: 'npm'

	- name: Install dependencies
	run: npm install --legacy-peer-deps

	- name: Build frontend
	run: npm run build

	- name: Build server
	run: npm run build:server

	- name: Check build artifacts
	run: \|
	echo "Checking frontend build..."
	ls -la dist/
	echo "Checking server build..."
	ls -la dist/server/

	docs-build:
	name: Documentation Build
	runs-on: ubuntu-latest

	# Absorbed from the retired pr-tests.yml, where it was the ONE job with
	# coverage this workflow did not already have. It is not redundant with
	# deploy-docs.yml: that only runs on push to main, i.e. after merge — so
	# without this, a VitePress build break is caught by the deploy, not the PR.
	#
	# Run unconditionally rather than behind a dorny/paths-filter `docs` gate.
	# The old gate keyed on `docs/` and `.md`, which missed the VitePress
	# config and the docs' own dependencies, and the build is ~1 min. Dropping
	# the gate is what let the `changed-files` job retire with pr-tests.yml.
	steps:
	- name: Checkout code
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

	- name: Setup Node.js
	uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
	with:
	node-version: '24.x'
	cache: 'npm'

	- name: Install dependencies
	run: npm install --prefer-offline --no-audit --legacy-peer-deps

	- name: Build documentation
	run: npm run docs:build

	docker:
	name: Docker Build
	runs-on: ubuntu-latest
	needs: test

	steps:
	- name: Checkout code
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	with:
	submodules: recursive

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

	- name: Build Docker image
	uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
	with:
	context: .
	push: false
	load: true
	tags: meshmonitor:test
	cache-from: type=gha
	cache-to: type=gha,mode=max

	- name: Test Docker image
	run: \|
	docker run --rm meshmonitor:test node --version
	docker run --rm meshmonitor:test ls -la /app/

	security:
	name: Security Scan
	runs-on: ubuntu-latest
	if: github.event_name == 'pull_request'

	steps:
	- name: Checkout code
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

	- name: Install Trivy
	run: \|
	sudo apt-get install -y wget apt-transport-https gnupg lsb-release
	wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key \| gpg --dearmor \| sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
	echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" \| sudo tee /etc/apt/sources.list.d/trivy.list
	sudo apt-get update
	sudo apt-get install -y trivy

	- name: Run Trivy vulnerability scanner
	run: trivy fs --scanners vuln --format sarif --output trivy-results.sarif --severity HIGH,CRITICAL .

	- name: Upload Trivy results to GitHub Security
	uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
	if: always()
	with:
	sarif_file: 'trivy-results.sarif'

	- name: Dependency audit
	run: npm audit --audit-level=moderate
	continue-on-error: true # Don't fail on audit issues for now

	clamav:
	name: ClamAV Scan
	runs-on: ubuntu-latest
	if: github.event_name == 'pull_request'

	steps:
	- name: Checkout code
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

	- name: Install & update ClamAV
	run: \|
	set -e
	sudo apt-get update
	sudo apt-get install -y clamav clamav-freshclam
	sudo systemctl stop clamav-freshclam \|\| true
	sudo freshclam --verbose

	- name: Setup Node.js
	uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
	with:
	node-version: 22.x
	cache: 'npm'

	- name: Install dependencies
	run: npm install --legacy-peer-deps

	- name: Verify ClamAV detects EICAR signature
	run: \|
	set -euo pipefail
	printf 'X5O!P%%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > eicar.com
	status=0
	clamscan eicar.com > eicar.log 2>&1 \|\| status=$?
	cat eicar.log
	if [ "$status" -ne 1 ]; then
	echo "ClamAV failed to detect EICAR test signature" >&2
	exit 1
	fi
	rm -f eicar.com eicar.log

	- name: Scan source tree
	run: \|
	set -euo pipefail
	clamscan -ri --exclude-dir='^\.git$' . \| tee clamav.log
	if grep -qE 'Infected files: [1-9][0-9]*' clamav.log; then
	echo "ClamAV found infected files!" >&2
	grep 'FOUND' clamav.log >&2
	exit 1
	fi

	- name: Upload scan results
	if: always()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
	with:
	name: clamav-scan-results
	path: clamav.log

	pr-comment:
	name: PR Comment
	runs-on: ubuntu-latest
	needs: [test, build, docker]
	if: github.event_name == 'pull_request'

	steps:
	- name: Comment on PR
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
	continue-on-error: true # Don't fail if we can't comment
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}
	script: \|
	const issue_number = context.payload.pull_request.number;
	const { owner, repo } = context.repo;

	const comment = `## ✅ CI Checks Passed

	All tests and builds completed successfully!

	- Tests: All unit tests passing
	- Type Check: No TypeScript errors
	- Build: Frontend and server built successfully
	- Docker: Image builds successfully

	Ready for review! 🚀`;

	// Check if we already commented
	const comments = await github.rest.issues.listComments({
	owner,
	repo,
	issue_number,
	});

	const botComment = comments.data.find(comment =>
	comment.user.type === 'Bot' &&
	comment.body.includes('CI Checks')
	);

	if (botComment) {
	// Update existing comment
	await github.rest.issues.updateComment({
	owner,
	repo,
	comment_id: botComment.id,
	body: comment
	});
	} else {
	// Create new comment
	await github.rest.issues.createComment({
	owner,
	repo,
	issue_number,
	body: comment
	});
	}

Navigation Menu

Uh oh!

feat(settings): read Node Display settings per-source (#4412 Phase 2) #8656

Workflow file

feat(settings): read Node Display settings per-source (#4412 Phase 2) #8656

Uh oh!

Workflow file for this run