KingandChris233
c84bfb98f3
* ci: optimize CI caching, concurrency, and Tauri security Address multiple CI/CD efficiency and security gaps identified during project optimization analysis. The changes reduce PR build times, prevent wasteful concurrent runs, tighten the Tauri security boundary, and eliminate unnecessary submodule fetches on non-macOS jobs. CI workflow improvements: - Add swatinem/rust-cache@v2 to both ci.yml jobs (android-check and cross-platform), matching the caching already present in release-tauri.yml. This converts PR Rust compilation from full rebuilds to incremental builds, saving an estimated 60-80% of compile time per run. - Add concurrency groups to all three workflows. PR pushes cancel superseded runs to free concurrency slots; tag pushes and manual dispatches are isolated by run_id to avoid mutually canceling release builds. Previously, rapid PR pushes triggered redundant parallel CI runs with no cancellation. - Unify Node version to 22 across release-tauri.yml and android-apk.yml, which were previously pinned to 20. This ensures consistent build environments across all workflows. Submodule and security hardening: - Conditionally fetch the vendor/qwen-asr submodule only on macOS jobs across all three workflows. The submodule is compiled exclusively by build.rs on macOS (build_qwen_asr_macos); Linux, Windows, and Android builds never reference it. Removing the unconditional recursive checkout eliminates a network fetch and a submodule-availability failure point on every non-macOS job. - Set withGlobalTauri to false in tauri.conf.json. The frontend exclusively uses @tauri-apps/api imports and never references the window.__TAURI__ global, so disabling it removes an unnecessary XSS attack surface without functional impact. Dependency hygiene: - Move @types/dompurify from dependencies to devDependencies in package.json. Type declaration packages are build-time only and should not ship in the production bundle. * fix(ci): address review findings * fix(ci): isolate manual CI workflow runs --------- Co-authored-by: Chris233 <h-chris233@outlook.com>
43 lines
1.2 KiB
JavaScript
43 lines
1.2 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { readFile } from 'node:fs/promises';
|
|
|
|
const config = JSON.parse(
|
|
await readFile(new URL('../src-tauri/tauri.conf.json', import.meta.url), 'utf8'),
|
|
);
|
|
const lifecycleE2e = await readFile(
|
|
new URL('./windows-openless-lifecycle-e2e.py', import.meta.url),
|
|
'utf8',
|
|
);
|
|
const miscCommands = await readFile(
|
|
new URL('../src-tauri/src/commands/misc.rs', import.meta.url),
|
|
'utf8',
|
|
);
|
|
|
|
assert.equal(
|
|
config.app.withGlobalTauri,
|
|
false,
|
|
'the application must not expose the global Tauri API bundle',
|
|
);
|
|
assert.match(
|
|
lifecycleE2e,
|
|
/window\.__TAURI_INTERNALS__\.invoke\(/,
|
|
'the Windows lifecycle E2E must invoke through the Tauri IPC bridge',
|
|
);
|
|
assert.doesNotMatch(
|
|
lifecycleE2e,
|
|
/window\.__TAURI__\./,
|
|
'the Windows lifecycle E2E must not depend on the disabled global Tauri API',
|
|
);
|
|
assert.match(
|
|
miscCommands,
|
|
/window\.__TAURI_INTERNALS__\.invoke\(/,
|
|
'the cursor-context debug example must use the available Tauri IPC bridge',
|
|
);
|
|
assert.doesNotMatch(
|
|
miscCommands,
|
|
/\b__TAURI__\./,
|
|
'debug documentation must not recommend the disabled global Tauri API',
|
|
);
|
|
|
|
console.log('tauri-api-surface-contract.test.mjs passed');
|