Repository navigation
chore(ci): enforce honest coverage thresholds; refresh stale contribu… - #28
Merged
Merged
Conversation
…tor docs Coverage (H6): the old 75/70/75/75 global threshold was never met (actual ~17%) and CI hid it with continue-on-error. - jest: per-file thresholds hold the security core (ssrf, rate-limit, workflow-graph, urw) and the execute-workflow route near their current 90-100%; global is a ratchet floor at today's measured level - ci: single blocking `pnpm test:ci` step replaces test + non-blocking coverage - verified: dropping ssrf tests fails the ssrf threshold Docs (H5): CONTRIBUTING project structure / node-type steps / Node 22 now match the code (builder in app/builder, validation + codegen in @charliesu/workflow-core, security controls in lib/security); remove link to a private docs path; TESTING.md, testing-guide.md and ci.md show real coverage numbers and the enforced policy. eslint: ignore generated coverage/ and Playwright report dirs.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Merged
csupenn
added a commit
that referenced
this pull request
Sep 26, 2026
## Description
Promote dev → main.
- fix(security): SSRF guard now blocks IPv4-mapped IPv6 targets in the
URL
parser's hex form, e.g. [::ffff:a9fe:a9fe] = cloud metadata (#29)
- test(security): validation-engine covered 0% → 100% lines; builder
Validation panel now uses the same SSRF/cycle rules the server enforces
(#30)
- chore(ci): coverage thresholds made honest and blocking; contributor
docs
refreshed (#28)
## Testing
Combined dev verified locally: type-check clean, lint 0 errors, test:ci
603 tests +
coverage thresholds, build OK.
## Security Impact
Closes an SSRF bypass on the HTTP Request node. Residual: DNS rebinding
(documented).
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
H5 + H6: make coverage thresholds honest and blocking; refresh stale contributor docs.
Type of Change
Testing
pnpm test:ci passes (538 tests). Dropping ssrf tests fails the ssrf threshold (enforcement verified).
Lint 0 errors, type-check clean, build OK.
Security Impact
Regressions in SSRF / rate-limit / cycle-detection / URW / execute-route test coverage now fail CI.
Details
Coverage (H6): the old 75/70/75/75 global threshold was never met (actual ~17%) and CI hid it with continue-on-error.
pnpm test:cistep replaces test + non-blocking coverageDocs (H5): CONTRIBUTING project structure / node-type steps / Node 22 now match the code (builder in app/builder, validation + codegen in @charliesu/workflow-core, security controls in lib/security); remove link to a private docs path; TESTING.md, testing-guide.md and ci.md show real coverage numbers and the enforced policy.
eslint: ignore generated coverage/ and Playwright report dirs.