The E2E workflow was failing during "Build frontend" because npm ci
was only run at root level. The frontend directory has its own
package.json with React, Tailwind, and other dependencies that were
never installed.
Add "Install frontend dependencies" step before build
Update Node.js version from 18 to 20 (required by markdownlint-cli2)
Fixes failing E2E tests in PR #550
The base tsconfig.json had types: ["vitest/globals", "@testing-library/jest-dom/vitest"]
which are devDependencies only installed during development. CI production
builds with npm ci --production don't include these, causing TS2688 errors.
Solution:
Remove types array from tsconfig.json (let TS auto-discover available types)
Simplify tsconfig.build.json to only exclude test files
Add triple-slash type references to test setup file
Add typecheck config to vitest.config.ts
This ensures:
Production builds work without devDependencies
Test files still have proper type definitions
No JSX.IntrinsicElements errors from missing React types
Set types to ["node"] instead of [] to maintain module resolution
Add explicit include: ["src"] to override parent's test file patterns
Add src/test-utils/** to exclusions to prevent test utilities in build
Fixes TS7026 "no interface JSX.IntrinsicElements" and module resolution
errors in CI production build.
GitHub Actions doesn't allow secrets context in step if expressions.
Add HAS_DOCKERHUB_TOKEN env var at job level that evaluates the secret
existence, then reference that env var in step conditions.
Fixes: "Unrecognized named-value: 'secrets'" workflow validation error
Override the types array in tsconfig.build.json to prevent
vitest and testing-library type definitions from being required
during production builds. These are devDependencies only needed
for test compilation.
Fixes CI E2E workflow failure: TS2688 "Cannot find type definition file"
Re-enable YAML validation to catch mistakes in workflow and compose
files. Remove empty exclude/association overrides that harm editor
performance.
Fixes review feedback on PR #550.
Replace misleading named volume with real tmpfs mount. E2E test data is
now truly ephemeral and fresh on every container start, with no state
leakage between test runs.
Fixes review feedback on PR #550.
Replace brittle stat/regex check with find -perm -0002 which correctly
handles directories with sticky/setgid bits (e.g., mode 1777).
Use chmod o-w instead of chmod 755 to preserve special bits when fixing
permissions, only removing the world-writable bit.
Fixes review feedback from Copilot on PR #550.
Publish Docker images to both Docker Hub (docker.io/wikid82/charon) and
GitHub Container Registry (ghcr.io/wikid82/charon) for maximum reach.
Add Docker Hub login with secret existence check for graceful fallback
Update docker/metadata-action to generate tags for both registries
Add Cosign keyless signing for both GHCR and Docker Hub images
Attach SBOM to Docker Hub via cosign attach sbom
Add Docker Hub signature verification to supply-chain-verify workflow
Update README with Docker Hub badges and dual registry examples
Update getting-started.md with both registry options
Supply chain security maintained: identical tags, signatures, and SBOMs
on both registries. PR images remain GHCR-only.
Add 404 status code to fallback conditions in hub_sync.go so the
integration gracefully falls back to GitHub mirror when primary
hub-data.crowdsec.net returns 404.
Add http.StatusNotFound to fetchIndexHTTPFromURL fallback
Add http.StatusNotFound to fetchWithLimitFromURL fallback
Update crowdsec_integration.sh to check hub availability
Skip hub preset tests gracefully when hub is unavailable
Fixes CI failure when CrowdSec Hub API is temporarily unavailable
After migrating base image from Alpine to Debian Trixie (PR #550),
integration test scripts were using wget-style options with curl
that don't work correctly on Debian.
Changed curl -q -O- (wget syntax) to curl -sf (proper curl):
waf_integration.sh
cerberus_integration.sh
rate_limit_integration.sh
crowdsec_startup_test.sh
install-go-1.25.5.sh
Also added future phase to plan for Playwright security test helpers
to prevent ACL deadlock issues during E2E testing.
Refs: #550
Abort broken rebase (193 commits), use merge instead
Remove feature/beta-release from Renovate baseBranches
Simplify propagate workflow: main → development → feature/*
Fix duplicate lines in codeql.yml from corrupted merge
Fix duplicate entries in package.json
Resolve Dockerfile conflict (keep node:24.13.0-slim for Trixie)
Add .hadolint.yaml to ignore DL3008/DL3059 for Debian images
Refs: #550
GitHub Actions
Jeremy
renovate[bot]
github-actions[bot]