Verify #322: frontend lint CI, indexer-first Anvil E2E, workflow docs #490

Merged
PlasticDigits merged 2 commits from verify/issue-322-ci-lint-e2e-indexer into main 2026-06-14 07:11:57 +00:00
PlasticDigits commented 2026-06-14 05:54:35 +00:00 (Migrated from gitlab.com)

Summary

  • Add npm run lint to the GitHub Actions frontend-test job (0 errors; 21 warnings allowed per #322 constraints).
  • Extend scripts/e2e-anvil.sh: default suite includes anvil-referrals.spec.ts; optional YIELDOMEGA_E2E_INDEXER=1 starts Postgres-backed indexer, inlines VITE_INDEXER_URL, and runs anvil-indexer-first.spec.ts.
  • Document GitLab vs GitHub CI split in docs/testing/ci.md and indexer-first E2E modes in docs/testing/e2e-anvil.md.
  • Refresh anvil-referrals.spec.ts for current referrals UI (Register code, One-time burn, mock wallet connect).

Acceptance checklist (#322)

Criterion Command / evidence Result
frontend-test runs lint .github/workflows/unit-tests.yml → npm run lint after typecheck PASS
E2E documents indexer-first mode docs/testing/e2e-anvil.md §301 table + YIELDOMEGA_E2E_INDEXER=1 section PASS
E2E implements indexer-first mode YIELDOMEGA_E2E_INDEXER=1 bash scripts/e2e-anvil.sh → anvil-indexer-first.spec.ts PASS (1/1 Playwright)
anvil-referrals.spec.ts in default flow bash scripts/e2e-anvil.sh → 7/7 Playwright (arena + referrals) PASS
ci.md explains GitLab/GitHub split docs/testing/ci.md § GitLab vs GitHub CI PASS
Frontend lint clean (errors) cd frontend && npm run lint PASS (0 errors, 21 warnings)
Indexer-first static smoke cd frontend && npm test includes indexerFirstDisplay.test.ts PASS (632 tests)

Test plan

  • cd frontend && npm run typecheck && npm run lint && npm test
  • bash scripts/e2e-anvil.sh
  • YIELDOMEGA_E2E_INDEXER=1 bash scripts/e2e-anvil.sh (indexer-first spec)

Follow-ups

  • Consider --max-warnings 0 on lint after clearing the 21 existing react-refresh / react-hooks warnings.
  • Optional: add YIELDOMEGA_E2E_INDEXER=1 to the e2e-anvil.yml workflow_dispatch job when GitHub runner Postgres setup is acceptable.

Note

Low Risk
Changes are limited to testing documentation and Playwright E2E; no production app or contract logic in the shown diff.

Overview
Documents optional indexer-first Anvil Playwright runs in docs/testing/ci.md: YIELDOMEGA_E2E_INDEXER=1 bash scripts/e2e-anvil.sh (Postgres + indexer + VITE_INDEXER_URL, GitLab #322).

Updates anvil-referrals.spec.ts so the connected-wallet register flow matches current referrals UI: explicit mock wallet connect before claiming a code, waits keyed off shared ARENA_E2E_TIMEOUT_MS, longer overall test budget (240s), and new checks for Register code and One-time burn before submitting registration.

Reviewed by Cursor Bugbot for commit 7495a1c264. Bugbot is set up for automated code reviews on this repo. Configure here.

## Summary - Add `npm run lint` to the GitHub Actions `frontend-test` job (0 errors; 21 warnings allowed per #322 constraints). - Extend `scripts/e2e-anvil.sh`: default suite includes `anvil-referrals.spec.ts`; optional `YIELDOMEGA_E2E_INDEXER=1` starts Postgres-backed indexer, inlines `VITE_INDEXER_URL`, and runs `anvil-indexer-first.spec.ts`. - Document GitLab vs GitHub CI split in `docs/testing/ci.md` and indexer-first E2E modes in `docs/testing/e2e-anvil.md`. - Refresh `anvil-referrals.spec.ts` for current referrals UI (`Register code`, `One-time burn`, mock wallet connect). ## Acceptance checklist (#322) | Criterion | Command / evidence | Result | |-----------|-------------------|--------| | `frontend-test` runs lint | `.github/workflows/unit-tests.yml` → `npm run lint` after typecheck | **PASS** | | E2E documents indexer-first mode | `docs/testing/e2e-anvil.md` §301 table + `YIELDOMEGA_E2E_INDEXER=1` section | **PASS** | | E2E implements indexer-first mode | `YIELDOMEGA_E2E_INDEXER=1 bash scripts/e2e-anvil.sh` → `anvil-indexer-first.spec.ts` | **PASS** (1/1 Playwright) | | `anvil-referrals.spec.ts` in default flow | `bash scripts/e2e-anvil.sh` → 7/7 Playwright (arena + referrals) | **PASS** | | `ci.md` explains GitLab/GitHub split | `docs/testing/ci.md` § GitLab vs GitHub CI | **PASS** | | Frontend lint clean (errors) | `cd frontend && npm run lint` | **PASS** (0 errors, 21 warnings) | | Indexer-first static smoke | `cd frontend && npm test` includes `indexerFirstDisplay.test.ts` | **PASS** (632 tests) | ## Test plan - [x] `cd frontend && npm run typecheck && npm run lint && npm test` - [x] `bash scripts/e2e-anvil.sh` - [x] `YIELDOMEGA_E2E_INDEXER=1 bash scripts/e2e-anvil.sh` (indexer-first spec) ## Follow-ups - Consider `--max-warnings 0` on lint after clearing the 21 existing `react-refresh` / `react-hooks` warnings. - Optional: add `YIELDOMEGA_E2E_INDEXER=1` to the `e2e-anvil.yml` workflow_dispatch job when GitHub runner Postgres setup is acceptable. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Changes are limited to testing documentation and Playwright E2E; no production app or contract logic in the shown diff. > > **Overview** > Documents optional **indexer-first** Anvil Playwright runs in `docs/testing/ci.md`: `YIELDOMEGA_E2E_INDEXER=1 bash scripts/e2e-anvil.sh` (Postgres + indexer + `VITE_INDEXER_URL`, GitLab #322). > > Updates **`anvil-referrals.spec.ts`** so the connected-wallet register flow matches current referrals UI: explicit **mock wallet connect** before claiming a code, waits keyed off shared **`ARENA_E2E_TIMEOUT_MS`**, longer overall test budget (240s), and new checks for **Register code** and **One-time burn** before submitting registration. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 7495a1c264a2cf63a0716b788310411d6bbc9f3b. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 05:54:52 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 05:55:00 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 05:55:59 +00:00 (Migrated from gitlab.com)

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit cbb2a904b9. Configure here.

<!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue. <!-- BUGBOT_FIX_ALL --> <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTo5M2YyOWFkNi0yOTlkLTQxMGYtYTJjZS03MDNhNjc2M2IyMzIiLCJlbmNyeXB0aW9uS2V5IjoiUGVoNV82QWhkWFR1LW5kRF9oUEY3Tng1UEJYSVNHQU9KT1h3V2xnWWF3dyIsImJyYW5jaCI6InZlcmlmeS9pc3N1ZS0zMjItY2ktbGludC1lMmUtaW5kZXhlciIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6InlpZWxkb21lZ2EifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <!-- /BUGBOT_FIX_ALL --> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the [Cursor dashboard](https://www.cursor.com/dashboard/bugbot).</sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit cbb2a904b97d1032f1df9fe04533bf3d13938bfb. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 05:56:00 +00:00 (Migrated from gitlab.com)

Stale E2E build cache

Medium Severity

Separate build stamps per indexer mode can reuse an older idx-none stamp while dist still embeds VITE_INDEXER_URL from a prior indexer-first build, so minimal runs skip npm run build and ship a production bundle that still polls the indexer.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit cbb2a904b9. Configure here.

### Stale E2E build cache **Medium Severity** <!-- DESCRIPTION START --> Separate build stamps per indexer mode can reuse an older `idx-none` stamp while `dist` still embeds `VITE_INDEXER_URL` from a prior indexer-first build, so minimal runs skip `npm run build` and ship a production bundle that still polls the indexer. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 2e6e9fd2-1114-4d19-9881-a28a3756b2ef --> <!-- LOCATIONS START scripts/e2e-anvil.sh#L256-L270 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjU5Zjk0OGVmLTM0M2MtNGM1Ny04NDM0LWNmNDA3ZTlkOGU5MyIsImVuY3J5cHRpb25LZXkiOiJpVDU1NUdlUlQzd0dTLU9ESFlfZzRBV1RDazRlS0Z1X3dXbUNJNWZRTG40IiwiYnJhbmNoIjoidmVyaWZ5L2lzc3VlLTMyMi1jaS1saW50LWUyZS1pbmRleGVyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoieWllbGRvbWVnYSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjU5Zjk0OGVmLTM0M2MtNGM1Ny04NDM0LWNmNDA3ZTlkOGU5MyIsImVuY3J5cHRpb25LZXkiOiJpVDU1NUdlUlQzd0dTLU9ESFlfZzRBV1RDazRlS0Z1X3dXbUNJNWZRTG40IiwiYnJhbmNoIjoidmVyaWZ5L2lzc3VlLTMyMi1jaS1saW50LWUyZS1pbmRleGVyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoieWllbGRvbWVnYSIsInByTnVtYmVyIjoxMjAsImNvbW1pdFNoYSI6ImNiYjJhOTA0Yjk3ZDEwMzJmMWRmOWZlMDQ1MzNiZjNkMTM5MzhiZmIiLCJwcm92aWRlciI6ImdpdGxhYiIsImhvc3RuYW1lIjoiZ2l0bGFiLmNvbSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit cbb2a904b97d1032f1df9fe04533bf3d13938bfb. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
PlasticDigits commented 2026-06-14 05:56:45 +00:00 (Migrated from gitlab.com)

Security review — MR !490

Commit reviewed: cbb2a904b97d1032f1df9fe04533bf3d13938bfb

Scope: .github/workflows/unit-tests.yml (add npm run lint), docs/testing/ci.md, docs/testing/e2e-anvil.md, scripts/e2e-anvil.sh (optional YIELDOMEGA_E2E_INDEXER=1 Postgres/indexer bootstrap), frontend/e2e/anvil-indexer-first.spec.ts (new), frontend/e2e/anvil-referrals.spec.ts (E2E harness updates).

Method: Full MR diff review; traced env/script inputs (YIELDOMEGA_E2E_INDEXER, INDEXER_PORT, deploy addresses, PLAYWRIGHT_SPECS) to sinks (shell, Postgres reset, indexer LISTEN_ADDR, Vite env inlining, Playwright). Checked for injection, authz bypass, secret leakage, SSRF/XSS, and EVM contract impact. Re-read existing MR notes — no prior security-review threads to re-validate.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Rationale (summary):

  • No production application, indexer, or smart-contract logic changes; surface is CI gating, documentation, and local/dev E2E orchestration.
  • Indexer mode binds to 127.0.0.1, uses existing postgres_cloud_agent.sh helpers with fixed dev DB name/credentials, and writes deploy addresses via jq --arg (no shell interpolation of untrusted input).
  • VITE_INDEXER_URL is set only from script-controlled INDEXER_URL (http://127.0.0.1:${INDEXER_PORT}) during optional indexer E2E; default path remains empty (unchanged behavior).
  • New Playwright specs are read-only UI smokes against local preview; no new attacker-controlled sinks.
  • INDEXER_PORT / unquoted PLAYWRIGHT_SPECS patterns mirror pre-existing verify/stack scripts and are operator-local env overrides, not new remote trust boundaries introduced by this MR.

Inline threads: none (no medium+ findings).

## Security review — MR !490 **Commit reviewed:** `cbb2a904b97d1032f1df9fe04533bf3d13938bfb` **Scope:** `.github/workflows/unit-tests.yml` (add `npm run lint`), `docs/testing/ci.md`, `docs/testing/e2e-anvil.md`, `scripts/e2e-anvil.sh` (optional `YIELDOMEGA_E2E_INDEXER=1` Postgres/indexer bootstrap), `frontend/e2e/anvil-indexer-first.spec.ts` (new), `frontend/e2e/anvil-referrals.spec.ts` (E2E harness updates). **Method:** Full MR diff review; traced env/script inputs (`YIELDOMEGA_E2E_INDEXER`, `INDEXER_PORT`, deploy addresses, `PLAYWRIGHT_SPECS`) to sinks (shell, Postgres reset, indexer `LISTEN_ADDR`, Vite env inlining, Playwright). Checked for injection, authz bypass, secret leakage, SSRF/XSS, and EVM contract impact. Re-read existing MR notes — no prior security-review threads to re-validate. **Outcome:** **FINDINGS: 0** medium+ Security review: no medium+ findings on this diff. **Rationale (summary):** - No production application, indexer, or smart-contract logic changes; surface is CI gating, documentation, and local/dev E2E orchestration. - Indexer mode binds to `127.0.0.1`, uses existing `postgres_cloud_agent.sh` helpers with fixed dev DB name/credentials, and writes deploy addresses via `jq --arg` (no shell interpolation of untrusted input). - `VITE_INDEXER_URL` is set only from script-controlled `INDEXER_URL` (`http://127.0.0.1:${INDEXER_PORT}`) during optional indexer E2E; default path remains empty (unchanged behavior). - New Playwright specs are read-only UI smokes against local preview; no new attacker-controlled sinks. - `INDEXER_PORT` / unquoted `PLAYWRIGHT_SPECS` patterns mirror pre-existing verify/stack scripts and are operator-local env overrides, not new remote trust boundaries introduced by this MR. **Inline threads:** none (no medium+ findings).
PlasticDigits commented 2026-06-14 06:55:35 +00:00 (Migrated from gitlab.com)

changed this line in version 2 of the diff

changed this line in [version 2 of the diff](/PlasticDigits/yieldomega/-/merge_requests/120/diffs?diff_id=1850611482&start_sha=cbb2a904b97d1032f1df9fe04533bf3d13938bfb#50daf5396705c90814f105bc61467227b5a436f1_261_277)
PlasticDigits commented 2026-06-14 06:55:35 +00:00 (Migrated from gitlab.com)

added 100 commits

  • cbb2a904...862964db - 99 commits from branch main
  • 7495a1c2 - Merge origin/main into verify/issue-322-ci-lint-e2e-indexer

Compare with previous version

added 100 commits <ul><li>cbb2a904...862964db - 99 commits from branch <code>main</code></li><li>7495a1c2 - Merge origin/main into verify/issue-322-ci-lint-e2e-indexer</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/120/diffs?diff_id=1850611482&start_sha=cbb2a904b97d1032f1df9fe04533bf3d13938bfb)
PlasticDigits commented 2026-06-14 06:55:38 +00:00 (Migrated from gitlab.com)

Resolved merge conflicts with origin/main (merge commit 7495a1c2).

Conflicts resolved:

  • docs/testing/ci.md — kept main's GitLab/GitHub CI anchor and table; preserved MR local-parity indexer-first E2E commands.
  • docs/testing/e2e-anvil.md — took main's indexer-first documentation (linked to ci.md §322).
  • scripts/e2e-anvil.sh — took main's _e2e_start_indexer_if_requested helper, ANVIL_E2E_INDEXER, and Kumbaya buy-router registry wiring.
  • frontend/e2e/anvil-indexer-first.spec.ts — took main's expanded assertions (4 podiums, timer epoch).
  • frontend/e2e/anvil-referrals.spec.ts — merged both sides: referrals-register-cost-amount / Claim cost plus Register code / One-time burn.

Sanity: cd frontend && npm run typecheck && npm run lint — PASS (0 errors).

Resolved merge conflicts with `origin/main` (merge commit `7495a1c2`). **Conflicts resolved:** - `docs/testing/ci.md` — kept main's GitLab/GitHub CI anchor and table; preserved MR local-parity indexer-first E2E commands. - `docs/testing/e2e-anvil.md` — took main's indexer-first documentation (linked to ci.md §322). - `scripts/e2e-anvil.sh` — took main's `_e2e_start_indexer_if_requested` helper, `ANVIL_E2E_INDEXER`, and Kumbaya buy-router registry wiring. - `frontend/e2e/anvil-indexer-first.spec.ts` — took main's expanded assertions (4 podiums, timer epoch). - `frontend/e2e/anvil-referrals.spec.ts` — merged both sides: `referrals-register-cost-amount` / Claim cost plus Register code / One-time burn. **Sanity:** `cd frontend && npm run typecheck && npm run lint` — PASS (0 errors).
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 06:55:53 +00:00 (Migrated from gitlab.com)

resolved all threads

resolved all threads
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 06:55:55 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-14 06:57:41 +00:00 (Migrated from gitlab.com)

Security review — MR !490

Commit reviewed: 7495a1c264a2cf63a0716b788310411d6bbc9f3b

Scope (post–origin/main merge): docs/testing/ci.md (local-parity comment for indexer-first E2E), frontend/e2e/anvil-referrals.spec.ts (mock-wallet connect helper, timeout/assertion updates for Register code / One-time burn UI).

Method: Full current MR diff review; traced test inputs (Date.now() referral code, Playwright page actions, clipboard grant on http://127.0.0.1:4173) to sinks. Re-read prior MR security review on cbb2a904 (broader pre-merge diff, 0 medium+) and Bugbot stale-build-cache thread — that item is E2E cache correctness, not an attacker-exploitable trust boundary; not re-reported here.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Rationale (summary):

  • No production frontend, indexer, or smart-contract logic changes; surface is documentation comments and Anvil-only Playwright harness code gated by ANVIL_E2E=1.
  • connectMockWallet mirrors existing arena E2E patterns (connectArenaWallet / pwMockWallet.ts); actions are local UI clicks against mock connector on loopback preview — no new remote input path.
  • Referral test code remains locally generated; clipboard permissions stay scoped to 127.0.0.1:4173.

Inline threads: none (no medium+ findings).

## Security review — MR !490 **Commit reviewed:** `7495a1c264a2cf63a0716b788310411d6bbc9f3b` **Scope (post–`origin/main` merge):** `docs/testing/ci.md` (local-parity comment for indexer-first E2E), `frontend/e2e/anvil-referrals.spec.ts` (mock-wallet connect helper, timeout/assertion updates for Register code / One-time burn UI). **Method:** Full current MR diff review; traced test inputs (`Date.now()` referral code, Playwright page actions, clipboard grant on `http://127.0.0.1:4173`) to sinks. Re-read prior MR security review on `cbb2a904` (broader pre-merge diff, 0 medium+) and Bugbot stale-build-cache thread — that item is E2E cache correctness, not an attacker-exploitable trust boundary; not re-reported here. **Outcome:** **FINDINGS: 0** medium+ Security review: no medium+ findings on this diff. **Rationale (summary):** - No production frontend, indexer, or smart-contract logic changes; surface is documentation comments and Anvil-only Playwright harness code gated by `ANVIL_E2E=1`. - `connectMockWallet` mirrors existing arena E2E patterns (`connectArenaWallet` / `pwMockWallet.ts`); actions are local UI clicks against mock connector on loopback preview — no new remote input path. - Referral test code remains locally generated; clipboard permissions stay scoped to `127.0.0.1:4173`. **Inline threads:** none (no medium+ findings).
PlasticDigits (Migrated from gitlab.com) merged commit 52b7512136 into main 2026-06-14 07:11:57 +00:00
PlasticDigits commented 2026-06-14 07:11:58 +00:00 (Migrated from gitlab.com)

mentioned in commit 52b7512136

mentioned in commit 52b7512136850486702b49f957d536b91adfd30a
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/yieldomega!490
No description provided.