Refuse an identity that names a person (#4) #23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| check: | |
| name: Typecheck, lint, test | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: Typecheck | |
| run: npm run typecheck | |
| - name: Lint | |
| run: npm run lint | |
| - name: Tests and coverage gate | |
| run: npm run coverage | |
| - name: Build | |
| run: npm run build | |
| conformance: | |
| name: Conformance against MongoDB | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| # NOT a `services:` container, deliberately. | |
| # | |
| # Sessions — and therefore the multi-document transactions a transfer needs | |
| # — require a replica set, which means mongod has to start with --replSet. | |
| # A service container cannot be given command arguments: `options:` reaches | |
| # `docker create`, not the container's command. So this job ran a plain | |
| # standalone for months while a comment above it said otherwise. | |
| # | |
| # `docker run` can pass the flag, so it does. | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: Start MongoDB as a single-node replica set | |
| run: | | |
| docker run -d --name mongo -p 27017:27017 mongo:7 \ | |
| --replSet rs0 --bind_ip_all | |
| for i in $(seq 1 30); do | |
| if docker exec mongo mongosh --quiet --eval 'db.adminCommand({ping:1}).ok' \ | |
| 2>/dev/null | grep -q 1; then break; fi | |
| sleep 2 | |
| done | |
| docker exec mongo mongosh --quiet \ | |
| --eval 'try { rs.initiate() } catch (e) { print(e.message) }' | |
| # The gate checks `setName`, not `isWritablePrimary`. | |
| # | |
| # This is the bug that hid the missing --replSet for months: a | |
| # standalone mongod reports isWritablePrimary true, so the old loop | |
| # printed "replica set is primary" and exited 0 against a server with | |
| # no replication at all. The transfer tests then failed with | |
| # "Transaction numbers are only allowed on a replica set member", | |
| # which reads like a broken adapter rather than a broken runner. | |
| # | |
| # setName exists only on a replica set member, so it cannot be true | |
| # for the wrong reason. | |
| for i in $(seq 1 30); do | |
| if docker exec mongo mongosh --quiet --eval 'db.hello().setName' \ | |
| 2>/dev/null | grep -q rs0; then | |
| echo "replica set rs0 is up"; exit 0 | |
| fi | |
| sleep 2 | |
| done | |
| echo "::error::mongod never joined replica set rs0 — transactions would be unavailable" | |
| docker logs mongo | tail -20 | |
| exit 1 | |
| - name: Conformance suite | |
| run: npx vitest run tests/conformance.test.ts | |
| env: | |
| MONGO_URL: mongodb://localhost:27017/?directConnection=true | |
| audit: | |
| name: Dependency audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - run: npm audit --audit-level=high |