Verify #322: frontend lint CI, indexer-first Anvil E2E, workflow docs #490
No reviewers
Labels
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
code/yieldomega!490
Loading…
Reference in a new issue
No description provided.
Delete branch "verify/issue-322-ci-lint-e2e-indexer"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
npm run lintto the GitHub Actionsfrontend-testjob (0 errors; 21 warnings allowed per #322 constraints).scripts/e2e-anvil.sh: default suite includesanvil-referrals.spec.ts; optionalYIELDOMEGA_E2E_INDEXER=1starts Postgres-backed indexer, inlinesVITE_INDEXER_URL, and runsanvil-indexer-first.spec.ts.docs/testing/ci.mdand indexer-first E2E modes indocs/testing/e2e-anvil.md.anvil-referrals.spec.tsfor current referrals UI (Register code,One-time burn, mock wallet connect).Acceptance checklist (#322)
frontend-testruns lint.github/workflows/unit-tests.yml→npm run lintafter typecheckdocs/testing/e2e-anvil.md§301 table +YIELDOMEGA_E2E_INDEXER=1sectionYIELDOMEGA_E2E_INDEXER=1 bash scripts/e2e-anvil.sh→anvil-indexer-first.spec.tsanvil-referrals.spec.tsin default flowbash scripts/e2e-anvil.sh→ 7/7 Playwright (arena + referrals)ci.mdexplains GitLab/GitHub splitdocs/testing/ci.md§ GitLab vs GitHub CIcd frontend && npm run lintcd frontend && npm testincludesindexerFirstDisplay.test.tsTest plan
cd frontend && npm run typecheck && npm run lint && npm testbash scripts/e2e-anvil.shYIELDOMEGA_E2E_INDEXER=1 bash scripts/e2e-anvil.sh(indexer-first spec)Follow-ups
--max-warnings 0on lint after clearing the 21 existingreact-refresh/react-hookswarnings.YIELDOMEGA_E2E_INDEXER=1to thee2e-anvil.ymlworkflow_dispatch job when GitHub runner Postgres setup is acceptable.changed the description
changed the description
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit
cbb2a904b9. Configure here.Stale E2E build cache
Medium Severity
Separate build stamps per indexer mode can reuse an older
idx-nonestamp whilediststill embedsVITE_INDEXER_URLfrom a prior indexer-first build, so minimal runs skipnpm run buildand ship a production bundle that still polls the indexer.Reviewed by Cursor Bugbot for commit
cbb2a904b9. Configure here.Security review — MR !490
Commit reviewed:
cbb2a904b97d1032f1df9fe04533bf3d13938bfbScope:
.github/workflows/unit-tests.yml(addnpm run lint),docs/testing/ci.md,docs/testing/e2e-anvil.md,scripts/e2e-anvil.sh(optionalYIELDOMEGA_E2E_INDEXER=1Postgres/indexer bootstrap),frontend/e2e/anvil-indexer-first.spec.ts(new),frontend/e2e/anvil-referrals.spec.ts(E2E harness updates).Method: Full MR diff review; traced env/script inputs (
YIELDOMEGA_E2E_INDEXER,INDEXER_PORT, deploy addresses,PLAYWRIGHT_SPECS) to sinks (shell, Postgres reset, indexerLISTEN_ADDR, Vite env inlining, Playwright). Checked for injection, authz bypass, secret leakage, SSRF/XSS, and EVM contract impact. Re-read existing MR notes — no prior security-review threads to re-validate.Outcome: FINDINGS: 0 medium+
Security review: no medium+ findings on this diff.
Rationale (summary):
127.0.0.1, uses existingpostgres_cloud_agent.shhelpers with fixed dev DB name/credentials, and writes deploy addresses viajq --arg(no shell interpolation of untrusted input).VITE_INDEXER_URLis set only from script-controlledINDEXER_URL(http://127.0.0.1:${INDEXER_PORT}) during optional indexer E2E; default path remains empty (unchanged behavior).INDEXER_PORT/ unquotedPLAYWRIGHT_SPECSpatterns mirror pre-existing verify/stack scripts and are operator-local env overrides, not new remote trust boundaries introduced by this MR.Inline threads: none (no medium+ findings).
changed this line in version 2 of the diff
added 100 commits
main7495a1c2- Merge origin/main into verify/issue-322-ci-lint-e2e-indexerCompare with previous version
Resolved merge conflicts with
origin/main(merge commit7495a1c2).Conflicts resolved:
docs/testing/ci.md— kept main's GitLab/GitHub CI anchor and table; preserved MR local-parity indexer-first E2E commands.docs/testing/e2e-anvil.md— took main's indexer-first documentation (linked to ci.md §322).scripts/e2e-anvil.sh— took main's_e2e_start_indexer_if_requestedhelper,ANVIL_E2E_INDEXER, and Kumbaya buy-router registry wiring.frontend/e2e/anvil-indexer-first.spec.ts— took main's expanded assertions (4 podiums, timer epoch).frontend/e2e/anvil-referrals.spec.ts— merged both sides:referrals-register-cost-amount/ Claim cost plus Register code / One-time burn.Sanity:
cd frontend && npm run typecheck && npm run lint— PASS (0 errors).resolved all threads
changed the description
Security review — MR !490
Commit reviewed:
7495a1c264a2cf63a0716b788310411d6bbc9f3bScope (post–
origin/mainmerge):docs/testing/ci.md(local-parity comment for indexer-first E2E),frontend/e2e/anvil-referrals.spec.ts(mock-wallet connect helper, timeout/assertion updates for Register code / One-time burn UI).Method: Full current MR diff review; traced test inputs (
Date.now()referral code, Playwright page actions, clipboard grant onhttp://127.0.0.1:4173) to sinks. Re-read prior MR security review oncbb2a904(broader pre-merge diff, 0 medium+) and Bugbot stale-build-cache thread — that item is E2E cache correctness, not an attacker-exploitable trust boundary; not re-reported here.Outcome: FINDINGS: 0 medium+
Security review: no medium+ findings on this diff.
Rationale (summary):
ANVIL_E2E=1.connectMockWalletmirrors existing arena E2E patterns (connectArenaWallet/pwMockWallet.ts); actions are local UI clicks against mock connector on loopback preview — no new remote input path.127.0.0.1:4173.Inline threads: none (no medium+ findings).
mentioned in commit
52b7512136