feat: E2E test suite, SQL generator fixes, security automation, versioning - #4
Merged
Conversation
…oning E2E test infrastructure (apps/e2e/): - Selenium WebDriver page objects: AppPage, ConnectionModal, MigrationPage - Full pipeline flow: connect → compare → migrate → history for all 10 dialects - data-testid attributes added to all UI components (ConnectionModal, SchemaTree, ObjectDetailPanel, MigrationProgressPanel, DeployConfirmDialog, TopToolbar, MigrationHistory) - Console error monitoring, screenshot capture, db-config helpers - Per-dialect test scripts + run-all.mjs sequential runner with log capture SQL generator fixes: - Fix DEFAULT/NOT NULL column order (Oracle requires DEFAULT first) - Fix ADDED procedural objects (VIEW/FUNCTION) generated after MODIFIED ALTER TABLE steps so views can reference newly-added columns - Fix drop ordering: TABLE drops before SEQUENCE/TYPE drops - Add createTypeStatement dialect hook; implement Postgres ENUM/composite/domain - LoadSchemas waits for connection status banner (reliable signal vs pre-existing DOM) Security automation: - GitHub Actions: dependency-security (npm audit + cargo audit + ESLint), secret-scan (Gitleaks diff-mode on PR, full-history on push), codeql (post-merge + weekly), release-gate (all checks gate GitHub Release draft on tag push) - Dependabot: weekly npm + cargo updates - ESLint security plugin: detect-child-process, detect-eval, detect-unsafe-regex - Fix: replace exec() template-string with spawn() array args in /driver/install endpoint — eliminates command injection via shell interpretation of packageName - SECURITY.md + docs/security/security-process.md Versioning: - All packages reset to 0.0.1 (was 1.0.0); format: 0.0.BUILD - GitHub Actions version-bump.yml auto-increments BUILD on every merge to main Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove `cache: npm` from all setup-node steps — package-lock.json is gitignored so the cache plugin fails with "lock file not found" - Add `continue-on-error: true` to SARIF upload steps in secret-scan.yml and codeql.yml — private repos need GitHub Advanced Security for the Code Scanning API; the scan itself still blocks on actual findings Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
run-allsequential runnerDEFAULT/NOT NULLorder, ADDED procedural objects generated afterALTER TABLE(view referencing new column), drop ordering (sequences after tables), PostgresCREATE TYPEdialect hooknpm audit+cargo audit), secret scanning (Gitleaks), CodeQL, release gate; Dependabot config; ESLint security rules;SECURITY.mdexec(\pnpm add ${pkg}`)withspawn('pnpm', ['add', pkg, ...])` to eliminate command injection in the driver-install endpoint0.0.1;version-bump.ymlauto-increments build number on every merge to mainSecurity automation details
dependency-securitysecret-scancodeqlrelease-gatev*pushTest plan
npx vitest run— 92/92 passcd apps/web && npx tsc --noEmit— cleannpx eslint .— 0 errors (8 informational warnings on legitimate fs calls)npm run test:e2ewith configured DB credentialsv0.0.2tag and confirmrelease-gate.ymlcreates a draft release🤖 Generated with Claude Code