code/cl8y-bridge-monorepo

Fork 0

fix(ci): fail closed on skipped security e2e and gate frontend tests #199

Open

PlasticDigits wants to merge 1 commit from issue/187 into main

PlasticDigits commented

2026-09-22 07:21:19 +00:00

Owner

Summary

cl8y-e2e run / full now exit non-zero when a security-critical test is Skip, even if failed() == 0. Explicit --quick still allowlists skips. canceler_detects_fraud_on_solana_destination is omitted from the default required set when SOLANA_ENABLED is unset (not coverage); a Skip of that name, or of canceler_solana_source_fraud_detection, still fails.
Removed the dead scripts/e2e-test.sh step from .github/workflows/e2e.yml. That job now runs canceler integration_test with --ignored after Anvil and LocalTerra are up. Missing EVM_BRIDGE_ADDRESS / TERRA_BRIDGE_ADDRESS fails the step and the test. #[ignore] stays, so a laptop cargo test does not run those cases.
Woodpecker frontend-hash-verify runs full npm run test:unit with no test-file arguments. New frontend-playwright-smoke runs e2e/wallet-connect.spec.ts on project chromium with E2E_UI_ONLY=1 (no compose).

Fixes #187.

Acceptance

AC1. Security-critical Skip with zero failures fails the suite (SuiteMode::Required).
AC2. --quick allowlists skips. Optional Solana live names that match canceler_* are not allowlisted; the destination-fraud case is omitted when SOLANA_ENABLED is unset so a passing suite still exits 0 and that case is not coverage.
AC3. .github/workflows and .woodpecker.yaml have no scripts/e2e-test.sh reference.
AC4. Woodpecker frontend unit step is npm run test:unit with no path filter.
AC5. Woodpecker Playwright smoke sets E2E_UI_ONLY=1, project chromium, e2e/wallet-connect.spec.ts, --workers=1. A failing step fails the pipeline.
AC6. e2e.yml runs cargo test --test integration_test --release -- --ignored with INTEGRATION_TEST=1 and both bridge addresses. Empty or missing addresses fail.
AC7. #[ignore] remains. cargo test --test integration_test without --ignored left those cases ignored.
AC8. docs/testing.md points at cl8y-e2e and the Woodpecker frontend steps.
AC9. No contract, operator, or frontend product behavior change.

Validation

cargo test --manifest-path packages/e2e/Cargo.toml --lib exit_policy — 9 passed (T1–T3, A1, A2).
cargo check --manifest-path packages/e2e/Cargo.toml --bins — cl8y-e2e binary typechecks.
cargo test --manifest-path packages/canceler/Cargo.toml --test integration_test — 10 passed, 10 ignored (AC7). Missing/empty bridge address panics (AC6 unit level).
rg e2e-test.sh .github .woodpecker.yaml — no hits (T4).

Gaps

Did not execute the Woodpecker Playwright smoke or full npm run test:unit here (no npm on this worker). The YAML is the gate; a live Woodpecker run still has to install Chromium and start Vite.
Did not run canceler --ignored against a live Anvil/LocalTerra. T7 (test_anvil_connectivity actually running) remains a CI-log check.
OPTIONAL_SOLANA_LIVE_ALLOWLIST is empty on purpose: every live Solana TestResult name in the suite is security-critical, so those skips are not allowlisted.

Docs

Invariants: docs/CI_TEST_INVARIANTS.md (INV-CI-SKIP-1, INV-CI-SKIP-2, INV-CI-E2E-1, INV-CI-FE-1, INV-CI-CAN-1).
Skill: skills/agent-ci-fail-closed.md.

## Summary - `cl8y-e2e run` / `full` now exit non-zero when a security-critical test is `Skip`, even if `failed() == 0`. Explicit `--quick` still allowlists skips. `canceler_detects_fraud_on_solana_destination` is omitted from the default required set when `SOLANA_ENABLED` is unset (not coverage); a `Skip` of that name, or of `canceler_solana_source_fraud_detection`, still fails. - Removed the dead `scripts/e2e-test.sh` step from `.github/workflows/e2e.yml`. That job now runs canceler `integration_test` with `--ignored` after Anvil and LocalTerra are up. Missing `EVM_BRIDGE_ADDRESS` / `TERRA_BRIDGE_ADDRESS` fails the step and the test. `#[ignore]` stays, so a laptop `cargo test` does not run those cases. - Woodpecker `frontend-hash-verify` runs full `npm run test:unit` with no test-file arguments. New `frontend-playwright-smoke` runs `e2e/wallet-connect.spec.ts` on project `chromium` with `E2E_UI_ONLY=1` (no compose). Fixes #187. ## Acceptance - AC1. Security-critical `Skip` with zero failures fails the suite (`SuiteMode::Required`). - AC2. `--quick` allowlists skips. Optional Solana live names that match `canceler_*` are not allowlisted; the destination-fraud case is omitted when `SOLANA_ENABLED` is unset so a passing suite still exits 0 and that case is not coverage. - AC3. `.github/workflows` and `.woodpecker.yaml` have no `scripts/e2e-test.sh` reference. - AC4. Woodpecker frontend unit step is `npm run test:unit` with no path filter. - AC5. Woodpecker Playwright smoke sets `E2E_UI_ONLY=1`, project `chromium`, `e2e/wallet-connect.spec.ts`, `--workers=1`. A failing step fails the pipeline. - AC6. `e2e.yml` runs `cargo test --test integration_test --release -- --ignored` with `INTEGRATION_TEST=1` and both bridge addresses. Empty or missing addresses fail. - AC7. `#[ignore]` remains. `cargo test --test integration_test` without `--ignored` left those cases ignored. - AC8. `docs/testing.md` points at `cl8y-e2e` and the Woodpecker frontend steps. - AC9. No contract, operator, or frontend product behavior change. ## Validation - `cargo test --manifest-path packages/e2e/Cargo.toml --lib exit_policy` — 9 passed (T1–T3, A1, A2). - `cargo check --manifest-path packages/e2e/Cargo.toml --bins` — `cl8y-e2e` binary typechecks. - `cargo test --manifest-path packages/canceler/Cargo.toml --test integration_test` — 10 passed, 10 ignored (AC7). Missing/empty bridge address panics (AC6 unit level). - `rg e2e-test.sh .github .woodpecker.yaml` — no hits (T4). ## Gaps - Did not execute the Woodpecker Playwright smoke or full `npm run test:unit` here (no `npm` on this worker). The YAML is the gate; a live Woodpecker run still has to install Chromium and start Vite. - Did not run canceler `--ignored` against a live Anvil/LocalTerra. T7 (`test_anvil_connectivity` actually running) remains a CI-log check. - `OPTIONAL_SOLANA_LIVE_ALLOWLIST` is empty on purpose: every live Solana `TestResult` name in the suite is security-critical, so those skips are not allowlisted. ## Docs - Invariants: `docs/CI_TEST_INVARIANTS.md` (INV-CI-SKIP-1, INV-CI-SKIP-2, INV-CI-E2E-1, INV-CI-FE-1, INV-CI-CAN-1). - Skill: `skills/agent-ci-fail-closed.md`.

PlasticDigits added 1 commit

2026-09-22 07:21:19 +00:00

fix(ci): fail closed on skipped security e2e and gate frontend tests

ci/woodpecker/pr/woodpecker Pipeline failed

Details

ci/woodpecker/push/woodpecker Pipeline failed

Details

10be0ea949

A security-critical skip was a green cl8y-e2e run, Woodpecker only executed three frontend files, and canceler integration never ran in the job that already has Anvil and LocalTerra.

Co-authored-by: Cursor <cursoragent@cursor.com>

PlasticDigits commented

2026-09-22 07:21:30 +00:00

Author

Owner

drain skip: no occupying job for rebase/fix-pr/CI-wait; remaining continue

ci/woodpecker/pr/woodpecker Pipeline failed

Required

Details

ci/woodpecker/push/woodpecker Pipeline failed

Details

This pull request is blocked because it's outdated.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin issue/187:issue/187

git switch issue/187

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

code/cl8y-bridge-monorepo!199

No description provided.

Rows
Columns