Add workflow to trigger lightning-node E2E on PRs #80
Conversation
Uses mdk-bot GitHub App to trigger E2E tests in lightning-node when PRs are opened against main.
martinsaposnic
force-pushed
the
feature/lightning-e2e-trigger
branch
from
f678969 to
2ae6273
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f678969829
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
packages/core/src/route.ts
Outdated
| } | ||
|
|
||
| // Success - redirect to checkout page | ||
| const checkoutUrl = new URL(`${result.data.checkoutPath}/${result.data.id}`, url.origin) |
There was a problem hiding this comment.
The GET handler sanitizes checkoutPath to avoid open redirects, but the success redirect uses result.data.checkoutPath (derived from the original query params) instead of the sanitized value. This means a signed URL that includes an absolute or protocol-relative checkoutPath (e.g., https://evil.com) will still redirect off-site on success, reintroducing the open redirect risk the sanitizer is meant to prevent. If the server generates signed URLs with any user-influenced checkoutPath, that allows redirecting users to an attacker-controlled domain. Consider using the sanitized checkoutPath (or re-sanitizing result.data.checkoutPath) when building the success redirect.
Useful? React with 👍 / 👎.
|
|
||
| jobs: | ||
| trigger-e2e: | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
nit: For simple stuff like this ubuntu-slim is better
Summary
Adds a workflow that triggers lightning-node E2E tests when PRs are opened against main.
How it works
mdk-botGitHub App for authentication (not PAT)repository_dispatchto lightning-nodeNote
This PR itself won't trigger the E2E (workflow doesn't exist on main yet).
After merging, subsequent PRs will trigger E2E tests.