Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 0 additions & 21 deletions .github/workflows/continuous-release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -54,9 +54,6 @@ jobs:
if: github.ref != 'refs/heads/beads-sync'
runs-on: ubuntu-latest
needs: [lint, typecheck]
permissions:
id-token: write
contents: read
steps:
- name: Checkout code
uses: actions/checkout@v4
Expand All @@ -70,27 +67,9 @@ jobs:
- name: Install dependencies
run: pnpm install --frozen-lockfile

- name: Install Doppler CLI
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removing Doppler auth breaks CI unit tests

High Severity

The Doppler CLI installation and authentication steps were removed from the test job, but the pnpm test command still runs and will invoke test scripts in multiple packages (fmodata, better-auth, cli, fmdapi) that use doppler run -- to inject secrets. Without Doppler authentication, these test commands will fail and break the CI workflow. The Doppler removal was intended to support removing E2E tests, but unit tests in these packages also depend on Doppler.

Fix in Cursor Fix in Web

uses: dopplerhq/cli-action@v3

- name: Get OIDC token
run: |
TOKEN=$(curl -s -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
"${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=https://github.com/$GITHUB_REPOSITORY_OWNER")
echo "OIDC_TOKEN=$(echo $TOKEN | jq -r '.value')" >> $GITHUB_ENV

- name: Authenticate with Doppler
run: |
doppler oidc login --scope=. --identity=${{ vars.DOPPLER_SERVICE_IDENTITY_ID }} --token=$OIDC_TOKEN
doppler configure set project proofkit
doppler configure set config test

- name: Run Unit Tests
run: pnpm test

- name: Run fmodata E2E Tests
run: pnpm --filter @proofkit/fmodata test:e2e

build:
if: github.ref != 'refs/heads/beads-sync'
runs-on: ubuntu-latest
Expand Down
1 change: 1 addition & 0 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
"sherif:fix": "pnpm sherif --fix",
"release": "turbo run build --filter={./packages/*} && changeset publish",
"test": "turbo run test",
"test:e2e": "turbo run test:e2e",
"knip": "knip",
"prepare": "husky"
},
Expand Down
13 changes: 13 additions & 0 deletions turbo.json
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,19 @@
"outputs": [],
"dependsOn": ["^build"]
},
"test:e2e": {
"inputs": [
"$TURBO_DEFAULT$",
"vitest.config.*",
"**/*.test.ts",
"**/*.test.tsx",
"**/*.spec.ts",
"**/*.spec.tsx"
],
"outputs": [],
"dependsOn": ["^build"],
"cache": false
},
"test:watch": {
"cache": false,
"persistent": true
Expand Down
Loading