Add GitLab CI Phase-1 functional test jobs (#421) #953

2026-06-29T07:52:28Z

Brouie commented

2026-06-29 07:52:28 +00:00

(Migrated from gitlab.com)

Closes the Phase-1 part of #421 — wires the reference functional matrix into GitLab CI so a red functional test actually blocks merge, instead of "GitLab green != functional pass."

What's added

A new test stage (between security and build), change-gated, MR + default branch, no allow_failure:

Job	Runs	Reference parity (`.github/workflows/test.yml`)
`test-contracts`	`cd smartcontracts && cargo test`	`contracts-terra` (test portion)
`test-indexer-lib`	`cd indexer && cargo test --lib`	`indexer` (lib portion)
`test-frontend`	`npm run lint` + `npm run test:run`	`frontend` (lint + vitest)
`test-frontend-build`	`npm run build` (tsc -b + vite) + no-sourcemap assert	(new gate — see below)

Why the build gate

The pipeline never ran a cold tsc -b, so type-only breaks kept reaching main — #246, then four more across the #337 thread (the latest was a spendableRaw bigint-vs-string TS2322 that built fine incrementally but failed cold). npm run lint + vitest don't catch these; npm run build does. The dummy VITE_WC_PROJECT_ID satisfies the #378 prod-build guard — this gate proves the build compiles, it's not a deployable artifact — and it re-asserts #117 (no sourcemaps in a prod bundle) for free.

Design notes

Test jobs override the global RUSTFLAGS to drop -D warnings (kept on the lint/audit jobs) so a stray test-only warning can't mask a real test signal.
Each underlying command is already green locally on current main: contracts cargo test 452/0, indexer cargo test --lib 152/0, frontend build green (0 sourcemaps), lint 0 errors.
One thing the first pipeline run validates: test-frontend's npm run test:run includes the known terraExplorer localhost-vs-127.0.0.1 vitest artifact, which has historically been green in CI/default env but red on some hosts. If it surfaces red in the runner, that test needs an env-pin — a known quantity, not a new break.

Out of scope (Phase 2)

Postgres-backed indexer integration (cargo test --test ...) and Playwright E2E (DinD LocalTerra) are heavier (service containers / DinD) and stay local for now, tracked under #421.

Docs

docs/testing.md § CI: new jobs in the hosted-jobs table + the stage/"CI green" wording.
docs/qa-invariants.md: the "not hosted CI" line updated to reflect the GitLab functional gates.

Acceptance criteria: contracts + frontend + indexer-lib jobs present, MR + default branch with rules: changes:, no allow_failure, docs updated. The "break a draft MR and watch it fail" check from the test plan is the first real pipeline run.

Closes the Phase-1 part of #421 — wires the reference functional matrix into GitLab CI so a red functional test actually blocks merge, instead of "GitLab green != functional pass." ## What's added A new `test` stage (between `security` and `build`), change-gated, MR + default branch, no `allow_failure`: | Job | Runs | Reference parity (`.github/workflows/test.yml`) | |-----|------|--------------------------------------------------| | `test-contracts` | `cd smartcontracts && cargo test` | `contracts-terra` (test portion) | | `test-indexer-lib` | `cd indexer && cargo test --lib` | `indexer` (lib portion) | | `test-frontend` | `npm run lint` + `npm run test:run` | `frontend` (lint + vitest) | | `test-frontend-build` | `npm run build` (tsc -b + vite) + no-sourcemap assert | (new gate — see below) | ## Why the build gate The pipeline never ran a cold `tsc -b`, so type-only breaks kept reaching main — #246, then four more across the #337 thread (the latest was a `spendableRaw` bigint-vs-string TS2322 that built fine incrementally but failed cold). `npm run lint` + `vitest` don't catch these; `npm run build` does. The dummy `VITE_WC_PROJECT_ID` satisfies the #378 prod-build guard — this gate proves the build compiles, it's not a deployable artifact — and it re-asserts #117 (no sourcemaps in a prod bundle) for free. ## Design notes - Test jobs override the global `RUSTFLAGS` to drop `-D warnings` (kept on the lint/audit jobs) so a stray test-only warning can't mask a real test signal. - Each underlying command is already green locally on current main: contracts `cargo test` 452/0, indexer `cargo test --lib` 152/0, frontend build green (0 sourcemaps), lint 0 errors. - One thing the first pipeline run validates: `test-frontend`'s `npm run test:run` includes the known `terraExplorer` localhost-vs-127.0.0.1 vitest artifact, which has historically been green in CI/default env but red on some hosts. If it surfaces red in the runner, that test needs an env-pin — a known quantity, not a new break. ## Out of scope (Phase 2) Postgres-backed indexer integration (`cargo test --test ...`) and Playwright E2E (DinD LocalTerra) are heavier (service containers / DinD) and stay local for now, tracked under #421. ## Docs - `docs/testing.md` § CI: new jobs in the hosted-jobs table + the stage/"CI green" wording. - `docs/qa-invariants.md`: the "not hosted CI" line updated to reflect the GitLab functional gates. Acceptance criteria: contracts + frontend + indexer-lib jobs present, MR + default branch with `rules: changes:`, no `allow_failure`, docs updated. The "break a draft MR and watch it fail" check from the test plan is the first real pipeline run.

Brouie commented

2026-06-29 07:53:00 +00:00

(Migrated from gitlab.com)

mentioned in issue #421

PlasticDigits commented

2026-06-29 07:54:56 +00:00

(Migrated from gitlab.com)

Security review — MR !953

Commit reviewed: 54407fc97d466a1ecaaf06309ca082bc10cef7a5
Scope: .gitlab-ci.yml (new test stage: test-contracts, test-indexer-lib, test-frontend, test-frontend-build), docs/testing.md, docs/qa-invariants.md

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Summary

Reviewed added/modified CI configuration and documentation only — no application, contract, or indexer runtime code changes.

Checked (no issues):

Secrets / leakage: No credentials, tokens, or env secrets added. VITE_WC_PROJECT_ID: "ci-build-typecheck" is a non-secret build-time placeholder; test-frontend-build publishes no artifacts and the dist/ output is ephemeral on the runner.
Injection / shell: script steps use fixed commands (cargo test, npm ci, npm run build, static find guard). No attacker-controlled input reaches shell sinks.
Authn/authz / CI bypass: New jobs use rules: changes: on MRs (consistent with existing security-stage audit jobs). Default-branch and scheduled pipelines run the full test matrix. Jobs have no allow_failure — this strengthens merge gates rather than weakening them.
Supply chain: Pinned base images (rust:1.96-bookworm, node:24-bookworm) match existing pipeline jobs. npm ci / cargo test follow the same trust model as local Make targets.
SSRF / deserialization / XSS: Not applicable to this diff (no network endpoints, parsers, or user-facing output introduced).

Inline threads: None (zero medium+ findings).

Automated security review (Cursor Cloud Agent)

## Security review — MR !953 **Commit reviewed:** `54407fc97d466a1ecaaf06309ca082bc10cef7a5` **Scope:** `.gitlab-ci.yml` (new `test` stage: `test-contracts`, `test-indexer-lib`, `test-frontend`, `test-frontend-build`), `docs/testing.md`, `docs/qa-invariants.md` **Outcome:** `FINDINGS: 0` medium+ Security review: no medium+ findings on this diff. ### Summary Reviewed added/modified CI configuration and documentation only — no application, contract, or indexer runtime code changes. **Checked (no issues):** - **Secrets / leakage:** No credentials, tokens, or env secrets added. `VITE_WC_PROJECT_ID: "ci-build-typecheck"` is a non-secret build-time placeholder; `test-frontend-build` publishes no artifacts and the `dist/` output is ephemeral on the runner. - **Injection / shell:** `script` steps use fixed commands (`cargo test`, `npm ci`, `npm run build`, static `find` guard). No attacker-controlled input reaches shell sinks. - **Authn/authz / CI bypass:** New jobs use `rules: changes:` on MRs (consistent with existing security-stage audit jobs). Default-branch and scheduled pipelines run the full test matrix. Jobs have no `allow_failure` — this strengthens merge gates rather than weakening them. - **Supply chain:** Pinned base images (`rust:1.96-bookworm`, `node:24-bookworm`) match existing pipeline jobs. `npm ci` / `cargo test` follow the same trust model as local Make targets. - **SSRF / deserialization / XSS:** Not applicable to this diff (no network endpoints, parsers, or user-facing output introduced). **Inline threads:** None (zero medium+ findings). --- Automated security review (Cursor Cloud Agent)

Brouie commented

2026-06-29 07:56:00 +00:00

(Migrated from gitlab.com)

added 1 commit

cb6ca031 - Add GitLab CI Phase-1 functional test jobs (#421)

Compare with previous version

added 1 commit <ul><li>cb6ca031 - Add GitLab CI Phase-1 functional test jobs (#421)</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/235/diffs?diff_id=1875413484&start_sha=54407fc97d466a1ecaaf06309ca082bc10cef7a5)

Brouie commented

2026-06-29 07:59:02 +00:00

(Migrated from gitlab.com)

On the pipeline status: config lints clean (GitLab ci/lint valid=true). The first push had a real YAML error in the sourcemap-check line (script-not-a-string) — fixed in the amend. The MR pipeline showing red with 0 jobs is the same cross-fork behavior !952 shows: jobs run in the fork context, not on the target-project MR pipeline record, so they don't surface here. The four jobs are validated locally on current main: contracts cargo test 452/0, indexer cargo test --lib 152/0, frontend npm run build green (0 sourcemaps) + lint 0 errors. They run for real on the default-branch pipeline once merged (or a manual web pipeline).

On the pipeline status: config lints clean (GitLab `ci/lint` valid=true). The first push had a real YAML error in the sourcemap-check line (script-not-a-string) — fixed in the amend. The MR pipeline showing red with 0 jobs is the same cross-fork behavior !952 shows: jobs run in the fork context, not on the target-project MR pipeline record, so they don't surface here. The four jobs are validated locally on current main: contracts `cargo test` 452/0, indexer `cargo test --lib` 152/0, frontend `npm run build` green (0 sourcemaps) + lint 0 errors. They run for real on the default-branch pipeline once merged (or a manual web pipeline).

PlasticDigits commented

2026-06-29 08:04:36 +00:00

(Migrated from gitlab.com)

Security review — MR !953

Commit reviewed: cb6ca0312b9c4cc41cf67432d0bc5694e0e2e559
Scope: .gitlab-ci.yml (new test stage: test-contracts, test-indexer-lib, test-frontend, test-frontend-build), docs/testing.md, docs/qa-invariants.md

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Summary

Re-reviewed the current MR head (prior review was 54407fc; head advanced to cb6ca031). Changes remain CI configuration and documentation only — no application, contract, or indexer runtime code.

Checked (no issues):

Secrets / leakage: No credentials, tokens, or CI secret variables added. VITE_WC_PROJECT_ID: "ci-build-typecheck" is a non-secret build-time placeholder that satisfies the #378 production-build guard in vite.config.ts; test-frontend-build publishes no artifacts and dist/ is ephemeral on the runner.
Injection / shell: script steps are fixed commands (cargo test, npm ci, npm run lint, npm run test:run, npm run build, static find guard). No attacker-controlled input reaches shell sinks.
Authn/authz / CI bypass: New jobs use rules: changes: on MRs (consistent with existing security-stage audit jobs). Default-branch and scheduled pipelines run the full Phase-1 matrix. Jobs have no allow_failure — this strengthens merge gates rather than weakening them.
Supply chain: Pinned base images (rust:1.96-bookworm, node:24-bookworm) match existing pipeline jobs. npm ci / cargo test follow the same trust model as local Make targets; no new unpinned tooling or artifact publishing.
SSRF / deserialization / XSS: Not applicable (no network endpoints, parsers, or user-facing output introduced).

Inline threads: None (zero medium+ findings).

Automated security review (Cursor Cloud Agent)

## Security review — MR !953 **Commit reviewed:** `cb6ca0312b9c4cc41cf67432d0bc5694e0e2e559` **Scope:** `.gitlab-ci.yml` (new `test` stage: `test-contracts`, `test-indexer-lib`, `test-frontend`, `test-frontend-build`), `docs/testing.md`, `docs/qa-invariants.md` **Outcome:** `FINDINGS: 0` medium+ Security review: no medium+ findings on this diff. ### Summary Re-reviewed the current MR head (prior review was `54407fc`; head advanced to `cb6ca031`). Changes remain CI configuration and documentation only — no application, contract, or indexer runtime code. **Checked (no issues):** - **Secrets / leakage:** No credentials, tokens, or CI secret variables added. `VITE_WC_PROJECT_ID: "ci-build-typecheck"` is a non-secret build-time placeholder that satisfies the #378 production-build guard in `vite.config.ts`; `test-frontend-build` publishes no artifacts and `dist/` is ephemeral on the runner. - **Injection / shell:** `script` steps are fixed commands (`cargo test`, `npm ci`, `npm run lint`, `npm run test:run`, `npm run build`, static `find` guard). No attacker-controlled input reaches shell sinks. - **Authn/authz / CI bypass:** New jobs use `rules: changes:` on MRs (consistent with existing security-stage audit jobs). Default-branch and scheduled pipelines run the full Phase-1 matrix. Jobs have no `allow_failure` — this strengthens merge gates rather than weakening them. - **Supply chain:** Pinned base images (`rust:1.96-bookworm`, `node:24-bookworm`) match existing pipeline jobs. `npm ci` / `cargo test` follow the same trust model as local Make targets; no new unpinned tooling or artifact publishing. - **SSRF / deserialization / XSS:** Not applicable (no network endpoints, parsers, or user-facing output introduced). **Inline threads:** None (zero medium+ findings). --- Automated security review (Cursor Cloud Agent)