diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index f79112a..6844aa2 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -70,6 +70,25 @@ jobs: - name: Run test coverage run: pnpm test:coverage + # ── CSP safety gate ───────────────────────────────────────── + # Imports + renders the built bundle under V8's + # --disallow-code-generation-from-strings (a CSP without 'unsafe-eval'). + # HARD gate: fails if this package OR its pinned @unlayer/exporters + # evaluates a string at import/render. Stays red until the catalog pins a + # CSP-safe (precompiled-template) @unlayer/exporters release. + - name: CSP safety gate + run: pnpm --filter @unlayer/react-elements test:csp + + # ── Storybook browser smoke test ──────────────────────────── + # Opens every story in headless Chromium and asserts each component + # paints visible content with no console / page errors. Runs against the + # production static build (storybook build → http-server). + - name: Install Playwright Chromium + run: pnpm --filter @unlayer/react-elements exec playwright install --with-deps chromium + + - name: Storybook smoke test + run: pnpm --filter @unlayer/react-elements test-storybook:ci + # ── Next.js integration test ──────────────────────────────── # Packs the built react-elements as a tarball and installs it # in a real Next.js app — exactly like a consumer would. diff --git a/CLAUDE.md b/CLAUDE.md index 7dcc109..d64820d 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -98,6 +98,8 @@ Example: `