17 Commits

Include renames

Author	SHA1	Message	Date
Dmitry VerkhoturovandGitHub	2640aaee9e	Reach what http cannot: the widget over TLS, embedded cross-origin (#2214) ... Every service in the suite spoke http, and the browser gates a whole class of behaviour on the page protocol: Secure cookies, SameSite=None, Partitioned, and any code reading location.protocol. None of it was executed, which is how setAuthCookie came to decorate its cookies with __Host- on https pages and survive for years. A TLS pair joins the stack: remark42 with SSL_TYPE=static on 8443, and an nginx serving a host page on its own name on 8444, both on a self-signed certificate that e2e/tls/generate.sh makes and .gitignore keeps out. Every context accepts it, and so does the readiness client, since those are the only servers either talks to. The instance also runs with AUTH_SEND_JWT_HEADER, which is what makes the widget write cookies of its own: without it the client-side writer never runs on any https page here and every assertion about the attributes it chooses is vacuous. Three cases. Signing in across origins and then reloading, which is the one the http cross-origin case cannot make: the widget holds its token in memory for the life of a page, so signing in and posting says nothing about persistence and only the reload asks whether the cookie was delivered, stored under a name the backend reads and sent back from a third-party frame. The cookies themselves, read out of the browser store while the widget is embedded elsewhere, since a cookie the browser refused is absent from that list entirely and one it kept but will not send is worse than useless: every copy of both names has to be Secure and SameSite=None, at least one has to be partitioned, and none may carry a __Host- prefix nothing on either side reads. And the same reload under a browser that blocks third-party cookies, which the widget's own partitioned pair is the only reason to survive. That last one needs a browser playwright does not offer: its default arguments disable ThirdPartyStoragePartitioning outright, so a run configured wrongly keeps every third-party cookie and the case would pass while asserting nothing. IgnoreDefaultArgs drops that list and re-supplies it without the one feature, and a control cookie set from inside the frame has to be refused before anything else is read, so a playwright release that changes the list fails as itself instead of going quietly vacuous. All three pass against master. What TLS still cannot reach, the OAuth popup above all, is written down in the README.	2026-08-23 14:58:23 -05:00
Dmitry VerkhoturovandGitHub	23be25d84a	Fix seven widget defects, including the cookies the separate-domain setup needs (#2197) ... * Drop the frontend workspace root and re-resolve the lockfile `frontend/` carried a `package.json`, a `pnpm-workspace.yaml` and the lockfile for a workspace of exactly one package. Two manifests meant two places to declare a version, and the app pin was the one that did not win: `preact` and `@babel/core` were each written twice, and a bump to the app manifest alone would have been a silent no-op, since `pnpm.overrides` decides and it lived at the root. Everything pnpm reads now lives in `frontend/apps/remark42`: dependencies, `packageManager`, `engines` and the overrides. `frontend/` keeps `.nvmrc`, `.husky` and `CLAUDE.md`, none of which pnpm reads. The directory nesting stays: every path in the repository points at `frontend/apps/remark42`, including the published contributing docs, so moving the package up would have rewritten 14 files to no benefit. Moving the manifest kept the old resolutions verbatim, which left optional peer subtrees the tree no longer reaches: `ts-node` under jest, `@swc/core` under webpack, `vitest` under `@testing-library/jest-dom`, `tslib` under `webpack-dev-server`. None is referenced by any config or source file here. Re-resolving drops 137 packages and moves 59 to versions already permitted by the ranges in the manifest, 1446 to 1308, with no direct dependency changing version: the five that look changed differ only in their peer suffix. Every file `pnpm build` produces is identical in size before and after. The frontend-deps stage of the Dockerfile sets `CI=true` so the `prepare` script skips husky, which has no git repository to install hooks into there. * Stop markdown-only changes triggering heavy workflows, and check the documented versions `ci-backend.yml`, `ci-build.yml` and `ci-frontend.yml` all end their path filters with `!**.md`. The e2e workflow did not, so a change to any markdown file under `frontend/` or `backend/` matched its `frontend/**` and `backend/**` entries and started a docker build and the whole browser suite. The release filter had the same hole and two of its own: it names `README.md` and `LICENSE` on purpose, since `.goreleaser.yml` packages both, so it now excludes markdown under `backend/` and `frontend/` only. `CLAUDE.md` and the installation page were listed as well, and neither is packaged. `ci-site.yml` goes on matching markdown, which is right, since the site is built from it. It excludes `CLAUDE.md`, so a future `site/CLAUDE.md` cannot start a site build, and `site/README.md`, which documents how to build the site rather than being part of it. The installation page tells a reader that a source build needs Go 1.25, Node 24+ and PNPM 10. Nothing kept those in step with `backend/go.mod`, `engines.node`, `packageManager` and `.nvmrc`, and the drift is silent: a wrong version in the docs builds and tests exactly as well as a right one. `.nvmrc` is the pin with form here, having sat at 16 through the whole node 20 migration because nothing red ever pointed at it. The check compares each stated version against its source and holds `.nvmrc` to `engines.node`, and it fails when the page states no version at all, so removing the claims cannot turn it into a check that passes by comparing nothing. Its own workflow rather than a step in an existing one, since the inputs span the backend module, the frontend manifest and the site. * Fix the cookie fallback page, asset path, message senders, auth teardown and cookies Two defects with the same origin: 5825a55b, the January 2021 frontend rewrite, first released in v1.7.0. It removed the build entry for comments.html while leaving both the template and the link to it in place, so the page the auth panel offers when third-party cookies are blocked has been a 404 ever since, for exactly the reader who has no other way in. The template needed no changes; it is built again, and an e2e case now opens it on a thread carrying a comment and waits for that comment, so the page being served, its inline script running and it asking for the thread named in its own query string are all covered. Against an image built without the plugin entry that case fails on the 404, which is the regression it exists for. It also fixed the public path to the domain root, so an instance mounted under a prefix, which manuals/separate-domain documents, asked for /web/google.svg when its own icons live under that prefix. Fifteen provider icons in remark.mjs and one in last-comments.mjs. The path is now derived from the url the bundle was loaded from, which is correct for both arrangements, and the file loader no longer overrides it. The host page also accepted postMessage from any window: every frame on a page can reach window.parent, and the handler resizes the widget, scrolls the page and opens the profile overlay. It now ignores anything that did not come from a frame this module created. A fourth, in the same family: the OAuth flow never tore its polling down. `subscribed` was declared, checked and cleared but never set, so the guard against a second subscription was dead code and every provider click attached another listener pair. The five minute deadline then rejected without unsubscribing, leaving those listeners and a retry that reschedules itself for as long as getUser returns null. Cross-domain is where getUser never stops returning null, so a reader on the arrangement manuals/separate-domain documents was left polling /auth/user once a minute for the life of the page, against a route capped at 2 req/s. It also rejected with no argument, and the caller stores that as the error state, so the interface had undefined to render. The deadline now tears the subscription down and rejects with an error. The message check had a second half. Hardening the parent left the widget document trusting any sender, and it acts on signout and theme, so anything holding a reference to the frame could sign a reader out. `auth.hooks` already checked `event.source !== window.parent`; that check is now a shared `isFromParent` and the three listeners that lacked it use it too. The origin cannot stand in for it, since the host page is whatever site embeds the widget and `ALLOWED_HOSTS` is enforced server side through `frame-ancestors`. And createInstance stacked its listeners. It reuses the marked iframe instead of building one, but installed three listeners plus a title observer on every call, while destroy could only reach the newest closure, so a second call without a destroy stranded a set for good. The listeners of the current instance are now detached before the next set goes on. Reuse and the ignored config are unchanged: that contract is open in the backlog note and not settled here. The auth cookies the embedded case needs were not being delivered, in both halves of the client's own writer. The name was decorated: setAuthCookie prefixed with __Host- whenever the page was https, so a real deployment wrote __Host-JWT and __Host-XSRF-TOKEN while the backend looks for JWT and the fetcher reads XSRF-TOKEN, and nothing anywhere reads a prefixed name. Nothing caught it because the prefix is applied from the page protocol and every test and the dev server run on http; there is now a second suite pinned to an https page, which is the only condition that shows it. And the attributes could not be delivered: both were SameSite=Strict, judged against the top-level site and not the request's own origin, so a Strict cookie is never sent from a third-party frame, which is the entire configuration this code exists for. They now follow the embedding, Strict while the widget shares its page origin and None with Secure and Partitioned once it does not, since that is the only third-party form browsers still accept. Over http in a third-party frame no combination works, and the strict form is written instead of one the browser would reject outright. That leaves the client half of #1877 working, whose reporter wanted AUTH_SEND_JWT_HEADER for exactly this arrangement, and whose first half merged as #1929. The server's own cookies still carry no Partitioned; that is upstream work in go-pkgz/auth. Two plan changes. A review pass corrected its central Path B premise, which said the first document render is anonymous permanently, in every configuration: it is anonymous in the configuration remark42 ships, go-pkgz/auth exposing XSRFIgnoreMethods and remark42 leaving it unset. The door is not shut, it is closed by a setting, and opening it is scoped security work and not a flag flip, because GET /deleteme deletes every comment a user has written and is a GET so the emailed link works. And the separate-domain arrangement is promoted from a constraint bullet to a named requirement with acceptance criteria, since a test that signs in and posts without reloading passes while persistence is entirely broken. Review found a seventh, and it was reachable only because of the first: comments.ejs built its title with innerHTML from the url query parameter, so restoring the build entry made a reflected XSS live on the instance origin, where the page is a top-level document, frame-ancestors does not apply and the /web CSP allows unsafe-inline. The anchor is now built through the DOM with textContent, and only http and https reach href, since escaping alone leaves a javascript: url working. Two e2e subtests pin both halves, and mutation testing separates them: restoring innerHTML fails four assertions, while keeping the escaping and dropping only the scheme guard fails the href one alone. Review also found the poll teardown test did not exercise the poll. handleWindowVisibilityChange is reachable only from the two listeners and from the retry it schedules itself, and the test dispatched neither, so no request was ever made and the assertion compared zero to zero; it passed with the teardown reverted. It now dispatches focus, asserts requests are being made and keep coming, and only then that they stop. And the teardown could not cancel an in-flight getUser: a null resolving after the deadline ran the code past the await and scheduled a fresh retry with nothing left to clear it. A closure-local flag checked after the await stops that, chosen over a second guard at the top of the handler because only one of the two is detectable by mutation and this is the one that prevents the stray timer rather than neutering it. The inline handler in the iframe template accepted messages from any window while acting on them through location.replace and document.title. It now takes only the parent, the same check the host page side makes.	2026-08-22 12:34:24 -05:00
Dmitry VerkhoturovandGitHub	4d5dae20e2	Broaden the e2e suite from 21 cases to 63, and harden its harness (#2196) ... * Pin the published /web surface in the e2e suite #2178 renamed the widget bundles from .js to .mjs and the URLs earlier releases served under those names stopped resolving. Three were noticed from the demo site; the rest, including every locale chunk, were found only by requesting the whole surface of both images over HTTP. #2192 restored them with a server-side alias, and nothing in the suite would have caught the break or would notice it returning. Two cases with deliberately different criteria. The documented names are written out, because the documentation decides that list and not the build: an operator pastes privacy.html into an OAuth application, the nginx manual proxies index.html by name, and the integration guides start from the embed script. Everything else is taken from the build itself, so whatever the bundler emitted has to serve identical bytes under its legacy .js name and parse as a classic script, which is the premise serving one under the other rests on. A third case requests a name that does not exist, without which a fallback serving one page for everything would keep the whole table green. All of them check the content type as well as the bytes: nosniff is set on every response, so a bundle served as text/plain is as broken as one that 404s while comparing equal. On e3d1d0e2, the commit before the alias, this fails with 32 red subtests. * Cover the widget behavior the e2e suite never drove Removing npm from the widget takes the jest tests with it, and everything here was protected by jest or by nothing at all. Signing out was untested at every level, and the panel repainting is the half that always works: the assertion after the reload is the one that catches a session the server never ended. The edit form has to hand back the source that was posted and not the rendered comment, which #2040 shipped the other way round, taking every entity and tag the author had written with it. A draft has to survive a reload and be gone once the comment is posted. A refused comment has to stay in the form with something said about it, so that case drives the backend's own restricted-words code and then retries with the route removed. Uploads had no browser coverage in either direction. The posted case asserts naturalWidth instead of visibility, since a broken src still renders as an empty box, and the failing case holds the intercepted request long enough for the in-flight state to be observed: without that, "the text is unchanged afterwards" would hold for an upload that never started. Moderation and reader-side hiding are asserted from a page other than the one that made the change. Hiding seeds a second author, so it proves one person is hidden and the thread not emptied, and both the blocked author and the moderated one carry the run id in their names: a block and a verification are properties of the user and outlive the run in the stack's database, so a fixed name works exactly once. Locales were the largest hole. Each catalog is a chunk fetched at runtime, and loadLocale falls back to english on any failure instead of throwing, exactly as an unrecognized name does, so every case compares the rendered string against the file on disk. One case per catalog covers that they are all served and render; another fetches one through the widget document and asserts it parsed, which is the half a chunk that serves but fails to parse would slip through. The delete page and the last-comments stylesheet had no coverage of any kind. Two things the suite itself needed. The widget's own aria-label is translated, so commentFormSel only ever finds an english widget and a localized case cannot use widget(). And the auth probe is capped at two requests a second for the whole suite, hard-coded in rest.go: the added cases pushed past it and the suite began manufacturing its own 429s, which render as a signed-out widget and fail whichever test happens to be signing in, so the pacing gap is wider and the locale cases stub the probe they never needed. * Harden the e2e harness against silent failures and stale stacks Three things the suite could not tell you about itself. A browser failure nothing asserts on now fails the test that caused it. Uncaught exceptions are the ones worth the machinery: a widget throwing while it renders leaves most of these cases green, since they assert on elements the browser lays out either way. Rate-limit responses are recorded as well as logged for the same reason. A test driving an error path declares what it expects by substring, so a case that means to break something says which thing. The stack the suite adopts is now checked against the sources under test. Every checkout builds the image tag the compose file names, so a stack from another worktree, or from this one before an edit, answers on these ports and passes every readiness probe while serving code nobody is looking at. stamp.sh digests what goes into the image, compose passes it as the revision label, and a mismatch is refused with what to do about it. Checked after our own build too, or a stamp that never reaches the image would be a guard that silently passes everything. assertSignedIn no longer waits out the whole timeout on a refused status read. /auth/ is capped at two requests a second for the entire suite, a bare literal at rest.go:242, and a case signing in on two pages spends that twice; when the read that repaints the panel is the one the limiter turns down, the widget shows signed out over a session that exists and no later request will ask again. The short first wait now ends in a focus handoff, which the widget answers by re-probing, and only then does the real wait run. A sign-in that genuinely failed still fails, since the second read finds no state either. That is what TestComment_AdminPinsAndVerifies and TestComment_BlockedAuthorCannotPost were failing on in CI while passing locally. signInAnon takes the page for that reason, and its callers pass it. * Cover iframe geometry, the embed contract and five deployment modes Seventeen cases for the parts of the widget that broke repeatedly and that nothing here could see, plus the areas jest was the only check on. Geometry is the biggest of them. The widget measures its own document and posts the number for the parent to apply, and every way that has gone wrong is invisible to assertions about elements, which read the same whether the frame is right, twice too tall or a strip. So: the first height the parent is given describes rendered content and not the preloader, the frame matches the document it holds and does not stand 24px taller, no_footer leaves the last comment inside the frame, and the frame follows the sign-in dropdown and the growing textarea and comes back down again. Each was verified by reintroducing the defect it covers and watching it fail: a 63px report before the real one, six pixels of body padding, and a frame sized under the content. The embed surface is the other half the widget cannot see. An element placeholder gives way to exactly one iframe carrying the embed's own marker, a second createInstance reuses it, destroy takes it away with its handles, and a theme change after load reaches both the element and the document. A page that posts a message of its own, which is all embed.ts's own title observer does, no longer empties an open login form. Five configurations that cannot share an instance get one each, since each changes the widget for every reader: an admin's unlimited edit window, a session carried in a header and not a cookie, an instance with no auth provider to offer, anonymous voting, and the notify module, without which email_notifications is false and the subscribe control never renders at all. The subscription round trip is the one place a token from a real message is exchanged for state the server keeps. Two things surfaced there and are left alone, both said so in place. The panel confirming an unsubscribe cannot be observed, because the click changes the step and the dropdown closes on an element no longer in the rerendered view, which the component notes as its own awkwardness; the case asserts the request and the answer, which is what decides whether the reader still gets mail. And the widget takes the subscribed state from user.email_subscription, absent from what it hydrates the user with on the next load, so after a reload it offers to subscribe somebody who already is. simple_view needs no instance, being a query parameter, so both branches run against the main one. A transient failure of the status probe has a case too: the session belongs to the server, and one refused answer must not end it. The suite runs about four and a half minutes now, so the workflow's own budget goes to 20m to match the Makefile, well inside the job timeout, and the workflow stamps the stack it starts the way the Makefile does. The locale case that loads the widget document directly is renamed for what it protects, the origin and CSP its chunks are fetched under. Telegram gets no test: the base URL is formatted inline inside go-pkgz/auth, so nothing here can point it elsewhere, and the fix belongs upstream in v1 and v2 both. Reported as #2208. Three things CI found that a laptop cannot. The anonymous sign-in form validates its input against pattern="[\p{L}\d\s_]+", and E2E_RUN_ID is "<run id>-<attempt>" on a runner, so every username built from it carried a hyphen the browser refused to submit: no request was made and the case waited out its timeout on a panel that was never going to change. Names are built by anonName now, which drops what the pattern does not allow and adds the pid, so a second run against a surviving stack does not meet its own blocked and verified users. signInAnon waits for the request the submit makes, so the next such refusal fails as itself. The admin instance takes its admin from an email address, not a name. remark42 hashes an anonymous id from the name and the client address together, to tell apart two people picking the same name, so the id written into ADMIN_SHARED_ID belonged to nobody on a runner and the instance had no admin at all: the countdown stayed, and the backend refused the edit. An email id is sha1 of the address, which is the same everywhere. The subscription case clears its own precondition and confirms through the page's session. The dev user is shared and a subscription outlives the run, so the panel opened on the subscribed step; and the panel moves to that step while its token textarea is still on screen, leaving no moment at which the control to submit it exists. Three settings of remark_config get cases of their own, none having had any: __colors__, which is the one setting that travels through window.name and not the query string, so nothing else in the suite would notice the path going; the url override, which is how a canonical address keeps one conversation across pages that differ; and the subscription controls an integrator turns off, with the both-shown case as the control. Writing the url case turned up a backend defect, reported as #2204 and not fixed here: a thread url containing "&" cannot be commented on at all. Sanitize runs the locator through SanitizeAsURL, which round-trips it through bluemonday, so the url is stored html-escaped; the bucket is created under the escaped key, the read-back uses the real one and answers 500, and every later find, count and feed asks for the real url and is told the thread is empty. Any page addressed with two query parameters is affected. The case uses a single-parameter url for that reason. Five more from the same audit, none needing a service. Collapsing a thread shrinks the frame, which every other geometry case would miss: they all assert growth, and a widget that only grew would satisfy them while leaving a hole under each collapsed thread. Voting gains the direction nothing covered, downvoting and its survival of a reload, and the rule the other vote cases work around, that your own comment offers no buttons and the backend refuses the vote anyway. A vote with the X-XSRF-TOKEN header stripped has to be refused. That check is why a document navigation, an iframe src among them, is always anonymous and why the widget hydrates its user over XHR, so anything designed around that wants it pinned. An unrecognized locale has to render English, which is loadLocale's only observable guarantee: it falls back the same way for a name it does not know and for a chunk it cannot fetch. And a comment's timestamp has to be the reader's own, which is the one part of rendering that cannot move to the server, asserted from a context in Kiritimati against the same Intl the widget uses. A host page on an origin the widget is not served from, which is the separate-domain setup the manuals describe and the configuration readers actually hit problems with. Every other host page here is served by remark42 itself, so the cross-site path was never taken: an nginx on its own name and port serves e2e/hostsite, and the case asserts the frame is revealed, which means its document loaded and reported itself inited across the origin boundary, and that the thread it renders is the one the page's address names. Signing in is left out on purpose, an embedded cookie needing SameSite=None, which browsers take only as Secure, and this stack speaks http; that is #1139 and not something a case here can settle. The other half is ALLOWED_HOSTS. The no-provider instance names only itself, so a page elsewhere embedding it is refused by the browser, the document never runs, and the reveal comes from the widget's own fallback five seconds later. Both directions are worth holding: without the fallback a mistyped host leaves a permanently invisible widget with nothing to say why, and without the refusal the setting does nothing. The host page's title reaching the stored comment gets a case, the path running the other way from everything else here: the page posts its title into the widget, the widget sends it with the comment, and it is what a feed and the admin listing show. Set after the widget is up, so it covers the observer embed.ts installs and not the value read at boot. max_shown_comments has no case. The setting reaches the widget, appears in the iframe's query string and changes nothing: four comments render with it set to two, which is #812, still open, where the reproduction is now recorded. A case for it would be red on master. The README gains what the suite cannot reach. Every service here speaks http, so anything the browser gates on the page protocol is invisible: a Secure cookie, anything keyed on window.location.protocol, and the SameSite=None with Secure and Partitioned form that is the only one an embedded frame can still use. That is not hypothetical, setAuthCookie having decorated its cookies with __Host- on any https page and survived precisely because nothing here runs on one. The cross-origin case names the assertion to add if the stack ever gets TLS, which is the reload: the widget holds its token in memory for the life of a page, so signing in and posting without reloading passes while persistence is broken. And the trap waiting for whoever acts on that: playwright's own default --disable-features argument carries ThirdPartyStoragePartitioning, and it beats both --test-third-party-cookie-phaseout and --block-third-party-cookies passed through Args, so a run meaning to prove the third-party case keeps an ordinary third-party cookie exactly as it would with no flags at all. IgnoreDefaultArgs is the lever, and a blocking run has to assert a control before anything it reports can be believed. None of it reaches the widget's own storage fallback either: IS_STORAGE_AVAILABLE stays true with partitioning enforced, chromium partitioning localStorage instead of denying it, so comments.html needs webkit and not a flag. The downvote case now actually corrects. It claimed the score ends where the second vote leaves it and never cast one, so #728, a reader taking a vote back, could break with it green. It also turns out the opposite vote takes the first one back instead of flipping it, so the score returns to zero and never reaches +1, which is what the case asserts, before and after a reload. Renamed for what it covers.	2026-08-22 11:59:37 -05:00
Dmitry VerkhoturovandGitHub	49bf83b09c	Address the review follow-ups from #2188, #2189 and #2190 (#2193) ... * Read the collapsed-threads key through getJsonItem `getFromLocalStorage` parsed the stored string directly, so anything malformed under `__remarkCollapsed` threw out of `restoreCollapsedThreads`. That call sits in `remark.tsx` ahead of the `render`, so the throw took the whole widget with it: the reader was left on the preloader, over a view preference. `getJsonItem` in `common/local-storage.ts` already wraps a parse of a localStorage key and returns null on failure, and null is a shape the check below already reads as empty. The rest of that function is total against whatever the browser holds, and the bare parse was the one way in. * Stop retrying a failed e2e test in CI The suite went in with one gotestsum rerun. It has no failures on record to justify that: 31 CI runs since it landed, all green, and no rerun report has ever been produced. A retry is what turns an intermittent regression into a green build, and while the suite is this young its own failures are the evidence worth keeping. `E2E_RUN_ID` stays. It stamps the threads a run works on with the CI run id, so a thread url in a trace or a log names the run it came from. It carries no data across: the stack is disposable, and a local run under the same id gets those urls on an empty database. * Stop two chooseUnusedPort comments claiming collisions cannot happen All four copies listen on :0, read the assigned port, close the listener and bind later, so nothing holds the number across that gap and another binary can take it. The copies in app/cmd and app/rest/api call a collision very unlikely, which is accurate; the ones in app and the example module said binaries never land on the same number, which is not, and a comment ruling out a port collision is what would send the next person chasing one somewhere else. All four now read the same. Closing the window rather than describing it means the server binding :0 itself and reporting the address it got, which is a larger change.	2026-08-22 02:23:56 -05:00
Dmitry VerkhoturovandGitHub	a0879b2336	Measure the iframe reveal budgets from inside the page (#2189) ... The three reveal tests timed their budgets from before `page.Goto`, so a slow navigation was spent against a window that belongs to the iframe. In `TestIframe_StaysHiddenUntilTheDocumentReportsInited` that made the test vacuous rather than flaky: on a navigation between 2.5 and 5 seconds the loop bounding the visibility assertion had no budget left, ran zero times, and the test passed having asserted nothing. Reproduced by delaying the demo document by three seconds, where the assertion ran 0 times before and runs 23 after. The timeout test had the mirror of it, with navigation counting toward the lower bound that exists to catch a shortened fallback. An init script now records, in the page, when the widget's iframe element enters the document and when its visibility first flips. `create-iframe.ts` arms its fallback a moment earlier, on the detached element, so these read a shade short and every bound is conservative in the same direction. Both bounds were also wider than the thing they guard. The hidden window now runs almost to the fallback rather than half of it, and the lower bound sits just under it rather than at three quarters, which a fallback shortened to four seconds used to clear. CI reruns a failing test once rather than failing the build on the first flake. A browser suite has a floor no amount of care removes, and one flake failing the build is what stops people trusting the suite. Once rather than twice, because a rerun stops at the first pass and each further attempt only widens the window where a real intermittent regression is absorbed. What needed a rerun is written to a report and uploaded with the traces, which are kept whether or not the job went green: a run that recovered on the rerun is exactly the one whose evidence used to be discarded.	2026-08-21 22:05:51 -05:00
Dmitry VerkhoturovandGitHub	ff77f41a3a	Move the e2e suite to Go and playwright-go (#2180) ... * Move the e2e suite to Go and playwright-go The seven playwright tests in `frontend/e2e` become twenty in `e2e/`, a separate Go module driving the same browsers through playwright-go. The npm project, its lockfile entries, its prettier config and `Dockerfile.e2e` go with it, leaving `frontend/` a single-member workspace. The suite covers posting with markdown, replying and the nesting that implies, editing inside the deadline and the backend refusing one outside it, deleting, voting with the optimistic score observed mid-flight and rolled back on failure, changing the sort, collapse persistence across a reload, dev, anonymous and email sign-in end to end, the profile iframe, and the two scripts that render into the host page rather than the widget's own frame. The rendering tests run in chromium, firefox and webkit. The rest sign in, sign-in needs the dev oauth2 provider, and reaching that by name from the host is chromium-only, so they run there alone. `compose-e2e-test.yml` runs remark42, a second instance with a short edit window so that path does not need a five-minute test, and mailpit, which catches the email verification message the suite reads back. Everything binds to the loopback interface: the stack holds a known secret and an admin shared id, and `go test` can start it unattended. The tests run on the host rather than in a container. Three settings there exist for the tests rather than for realism. `REMARK_URL` uses a hostname because the dev oauth2 server binds whatever host it reads out of it, and a loopback bind inside a container cannot be published. `UPDATE_LIMIT` is raised because the default of 0.5/sec rejects any test posting twice in a row. The suite also paces its own `/auth/` calls, which are capped at 2/sec by a bare literal in `rest.go` rather than by a setting. Each test gets its own comment thread from a query string on the demo page, so nothing has to reset the database between runs. CI gains a vet and lint job for the module, since the build tag keeps it out of a plain `go test ./...`, and uploads a browser trace for any test that fails. `e2e/README.md` carries the rest: how to run it, what the stack is for, and the widget behaviour the assertions have to work around. * Update golangci-lint to 2.13.1 in the backend workflow The pin sat three minors behind what the linter installs locally, so CI checked the backend with an older set of rules than anyone running it by hand. 2.10.1 also fetches its config schema over the network on every `config verify`, which is a failure mode with no bearing on the code. Both targets are clean on 2.13.1, `backend/app` and the memory_store example.	2026-08-21 17:53:12 -05:00
dependabot[bot]andUmputun	8318f89dde	chore(deps): bump the github-actions-updates group across 1 directory with 4 updates ... Bumps the github-actions-updates group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/cache](https://github.com/actions/cache), [pnpm/action-setup](https://github.com/pnpm/action-setup) and [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) Updates `actions/cache` from 5 to 6 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/v5...v6) Updates `pnpm/action-setup` from 6.0.4 to 6.0.9 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](https://github.com/pnpm/action-setup/compare/v6.0.4...v6.0.9) Updates `codecov/codecov-action` from 6 to 7 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: pnpm/action-setup dependency-version: 6.0.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-updates - dependency-name: codecov/codecov-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-30 15:57:05 -05:00
3 people	5d6599237d	Bump the github-actions-updates group across 1 directory with 7 updates (#2034) ... Bumps the github-actions-updates group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3` | `4` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `4.2.0` | `5.0.0` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5` | `6` | | [docker/login-action](https://github.com/docker/login-action) | `3` | `4` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6` | `7` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6` | `7` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `7` | `8` | Updates `docker/setup-buildx-action` from 3 to 4 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4) Updates `pnpm/action-setup` from 4.2.0 to 5.0.0 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](https://github.com/pnpm/action-setup/compare/v4.2.0...v5.0.0) Updates `codecov/codecov-action` from 5 to 6 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/v5...v6) Updates `docker/login-action` from 3 to 4 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v3...v4) Updates `docker/build-push-action` from 6 to 7 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/v6...v7) Updates `actions/upload-artifact` from 6 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v6...v7) Updates `actions/download-artifact` from 7 to 8 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v7...v8) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: pnpm/action-setup dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: codecov/codecov-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: docker/login-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: docker/build-push-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-21 19:29:38 -05:00
dependabot[bot]andGitHub	4c9a791d6d	Bump the github-actions-updates group with 3 updates ... Bumps the github-actions-updates group with 3 updates: [actions/cache](https://github.com/actions/cache), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [actions/download-artifact](https://github.com/actions/download-artifact). Updates `actions/cache` from 4 to 5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/v4...v5) Updates `actions/upload-artifact` from 5 to 6 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v5...v6) Updates `actions/download-artifact` from 6 to 7 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: actions/upload-artifact dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: actions/download-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates ... Signed-off-by: dependabot[bot] <support@github.com>	2026-01-01 11:09:55 +00:00
Dmitry VerkhoturovandGitHub	41b75eba08	Merge pull request #1977 from umputun/docker-native-arm64-runners ... Improve GitHub Actions workflows security and performance	2025-12-08 14:46:13 -06:00
dependabot[bot]andUmputun	a311ff7b38	Bump the github-actions-updates group across 1 directory with 6 updates ... Bumps the github-actions-updates group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `5` | | [actions/setup-go](https://github.com/actions/setup-go) | `5` | `6` | | [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `6` | `8` | | [actions/setup-node](https://github.com/actions/setup-node) | `4` | `6` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `4.1.0` | `4.2.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `5` | Updates `actions/checkout` from 4 to 5 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v5) Updates `actions/setup-go` from 5 to 6 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v5...v6) Updates `golangci/golangci-lint-action` from 6 to 8 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](https://github.com/golangci/golangci-lint-action/compare/v6...v8) Updates `actions/setup-node` from 4 to 6 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v4...v6) Updates `pnpm/action-setup` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](https://github.com/pnpm/action-setup/compare/v4.1.0...v4.2.0) Updates `actions/upload-artifact` from 4 to 5 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: actions/setup-go dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: golangci/golangci-lint-action dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: pnpm/action-setup dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-updates - dependency-name: actions/upload-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates ... Signed-off-by: dependabot[bot] <support@github.com>	2025-12-03 11:43:50 -06:00
Dmitry VerkhoturovandUmputun	c42511d5a1	Fix cache-dependency-path for actions/setup-go caching to work, fix CI files path	2024-11-10 17:25:16 -06:00
dependabot[bot]andUmputun	3c110eb0ec	Bump the github-actions-updates group with 5 updates ... Bumps the github-actions-updates group with 5 updates: | Package | From | To | | --- | --- | --- | | [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `3` | `6` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `2.4.0` | `4.0.0` | | [actions/cache](https://github.com/actions/cache) | `3` | `4` | | [andresz1/size-limit-action](https://github.com/andresz1/size-limit-action) | `7313b26c76b3666c1dc41e2ca05370e201a9b7de` | `94bc357df29c36c8f8d50ea497c3e225c3c95d1d` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `2` | `4` | Updates `golangci/golangci-lint-action` from 3 to 6 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](https://github.com/golangci/golangci-lint-action/compare/v3...v6) Updates `pnpm/action-setup` from 2.4.0 to 4.0.0 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](https://github.com/pnpm/action-setup/compare/v2.4.0...v4.0.0) Updates `actions/cache` from 3 to 4 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/v3...v4) Updates `andresz1/size-limit-action` from 7313b26c76b3666c1dc41e2ca05370e201a9b7de to 94bc357df29c36c8f8d50ea497c3e225c3c95d1d - [Release notes](https://github.com/andresz1/size-limit-action/releases) - [Commits](https://github.com/andresz1/size-limit-action/compare/7313b26c76b3666c1dc41e2ca05370e201a9b7de...94bc357df29c36c8f8d50ea497c3e225c3c95d1d) Updates `actions/upload-artifact` from 2 to 4 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v2...v4) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: pnpm/action-setup dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: actions/cache dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates - dependency-name: andresz1/size-limit-action dependency-type: direct:production dependency-group: github-actions-updates - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-updates ... Signed-off-by: dependabot[bot] <support@github.com>	2024-11-08 15:56:59 -06:00
Dmitry VerkhoturovandUmputun	d2027f5241	switch playwright (e2e) to latest stable version	2024-07-30 20:23:06 -05:00
Dmitry VerkhoturovandUmputun	884b5685eb	update docker images and github CI actions	2024-01-11 01:26:30 -06:00
Dmitry VerkhoturovandUmputun	c0e8520d31	fix makefile and dockerfile ... Here are multiple changes to commands run by Makefile based on my attempts to run it on an Oracle Linux machine with the latest Docker.	2022-09-17 13:05:56 -05:00
Pavel MineevandDmitry Verkhoturov	0f7ac514fb	add e2e tests	2022-09-10 11:00:34 +02:00