Add comprehensive E2E testing infrastructure including:
docker-compose.playwright.yml for test environment orchestration
TestDataManager utility for per-test namespace isolation
Wait helpers for flaky test prevention
Role-based auth fixtures for admin/user/guest testing
GitHub Actions e2e-tests.yml with 4-shard parallelization
Health check utility for service readiness validation
Phase 0 of 10-week E2E testing plan (Supervisor approved 9.2/10)
All 52 existing E2E tests pass with new infrastructure
Implements all 13 fixes identified in the CI/CD audit against
github-actions-ci-cd-best-practices.instructions.md
Critical fixes:
Remove hardcoded encryption key from playwright.yml (security)
Fix artifact filename mismatch in supply-chain-pr.yml (bug)
Pin GoReleaser to ~> v2.5 instead of latest (supply chain)
High priority fixes:
Upgrade CodeQL action from v3 to v4 in supply-chain-pr.yml
Add environment protection for release workflow
Fix shell variable escaping ($$ → $) in release-goreleaser.yml
Medium priority fixes:
Add timeout-minutes to playwright.yml (20 min)
Add explicit permissions to quality-checks.yml
Add timeout-minutes to codecov-upload.yml jobs (15 min)
Fix benchmark.yml permissions (workflow-level read, job-level write)
Low priority fixes:
Add timeout-minutes to docs.yml jobs (10/5 min)
Add permissions block to docker-lint.yml
Add timeout-minutes to renovate.yml (30 min)
Separate PR-specific tests from docker-build.yml into dedicated workflows
that trigger via workflow_run. This creates a cleaner CI architecture where:
playwright.yml: E2E tests triggered after docker-build completes
security-pr.yml: Trivy binary scanning for PRs
supply-chain-pr.yml: SBOM generation + Grype vulnerability scanning
The E2E test "should show script path field when Script type is selected"
was failing because the locator didn't match the actual UI field.
Update locator from /create/i to /script path/i
Update placeholder matcher from /create-dns/i to /dns-challenge.sh/i
Matches actual ScriptProvider field: label="Script Path",
placeholder="/scripts/dns-challenge.sh"
Also includes skill infrastructure for Playwright (separate feature):
Add test-e2e-playwright.SKILL.md for non-interactive test execution
Add run.sh script with argument parsing and report URL output
Add VS Code tasks for skill execution and report viewing
Complete documentation overhaul for DNS Challenge Support feature (PR #461):
Rewrite features.md as marketing overview (87% reduction: 1,952 → 249 lines)
Organize features into 8 logical categories with "Learn More" links
Add comprehensive dns-challenge.md with:
15+ supported DNS providers (Cloudflare, Route53, DigitalOcean, etc.)
Step-by-step setup guides
Provider-specific configuration
Manual DNS challenge workflow
Troubleshooting section
Create 18 feature documentation stub pages
Update README.md with DNS Challenge in Top Features section
Refs: #21, #461
- Implement API tests for DNS Provider Types, validating built-in and custom providers.
- Create UI tests for provider selection, ensuring all types are displayed and descriptions are shown.
- Introduce fixtures for consistent test data across DNS Provider tests.
- Update manual DNS provider tests to improve structure and accessibility checks.
Implement Phase 3 of Custom DNS Provider Plugin Support with comprehensive
security controls for external plugin loading.
Add CHARON_PLUGIN_SIGNATURES env var for SHA-256 signature allowlisting
Support permissive (unset), strict ({}), and allowlist modes
Add directory permission verification (reject world-writable)
Configure container with non-root user and read-only plugin mount option
Add 22+ security tests for permissions, signatures, and allowlist logic
Create plugin-security.md operator documentation
Security controls:
Signature verification with sha256: prefix requirement
World-writable directory rejection
Non-root container execution (charon user UID 1000)
Read-only mount support for production deployments
Documented TOCTOU mitigation with atomic deployment workflow
Phase 1 of Custom DNS Provider Plugin Support: the /api/v1/dns-providers/types
endpoint now returns types dynamically from the dnsprovider.Global() registry
instead of a hardcoded list.
Backend handler queries registry for all provider types, metadata, and fields
Response includes is_built_in flag to distinguish plugins from built-ins
Frontend types updated with DNSProviderField interface and new response shape
Fixed flaky WAF exclusion test (isolated file-based SQLite DB)
Updated operator docs for registry-driven discovery and plugin installation
Refs: #461
- Created `pr_461_remediation_complete.md` detailing the final remediation status, including bug fixes, test results, and coverage metrics.
- Added `pr_461_vulnerability_comment.md` summarizing the supply chain vulnerabilities accepted for PR #461, including risk assessments and mitigation strategies.
- Established `VULNERABILITY_ACCEPTANCE.md` to formally document the acceptance of 9 vulnerabilities in Alpine Linux packages, outlining the rationale, monitoring plans, and compliance with industry standards.
These documents ensure transparency and provide a clear audit trail for the vulnerability management process associated with PR #461.
- Updated context key definitions in dns_provider_service_test.go to use string constants instead of custom types for user_id, client_ip, and user_agent.
- Ensured proper context values are set in audit logging tests to avoid defaulting to "system" or empty values.
- Enhanced in-memory SQLite database setup in credential_service_test.go to use WAL mode and busy timeout for better concurrency during tests.
- Updated current specification to reflect the integration of Staticcheck into pre-commit hooks.
- Added problem statement, success criteria, and implementation plan for Staticcheck integration.
- Enhanced QA validation report to confirm successful implementation of Staticcheck pre-commit blocking.
- Created new Playwright configuration and example test cases for frontend testing.
- Updated package.json and package-lock.json to include Playwright and related dependencies.
- Archived previous QA report for CI workflow documentation updates.
- Updated references from `CPMP_TOKEN` to `CHARON_TOKEN` in beta release draft PR body, beta release PR body, and GitHub setup documentation.
- Enhanced clarity in documentation regarding the use of `GITHUB_TOKEN` and fallback options.
- Removed outdated sections from the archived plan for the Docs-to-Issues workflow fix, streamlining the document.
- Initiated integration of Staticcheck into pre-commit hooks to improve code quality, including updates to Makefile, VS Code tasks, and documentation.
- Mark current specification as complete and ready for the next task.
- Document completed work on CI/CD workflow fixes, including implementation summary and QA report links.
- Archive previous planning documents related to GitHub security warnings.
- Revise QA report to reflect the successful validation of CI workflow documentation updates, with zero high/critical issues found.
- Add new QA report for Grype SBOM remediation implementation, detailing security scans, validation results, and recommendations.
- Removed outdated security remediation plan for DoD failures, indicating no active specifications.
- Documented recent completion of Grype SBOM remediation, including implementation summary and QA report.
- Updated QA report to reflect successful validation of security scans with zero HIGH/CRITICAL findings.
- Deleted the previous QA report file as its contents are now integrated into the current report.
- Moved the existing patch coverage remediation plan from `current_spec.md` to a new file `patch_coverage_spec.md` for better organization and focus on security remediation.
- Updated the goal to emphasize restoring Codecov patch coverage to green by ensuring 100% of modified lines are executed by tests.
- Defined two workstreams: one for fixing patch coverage in specific backend files and another for updating prevention measures in instructions and agent files.
- Added a detailed missing files table to track Codecov patch report line ranges and corresponding test strategies.
- Included guidance on handling partial patch lines and common patterns for missed coverage.
- Specified a remediation plan with a test-first approach and per-file testing strategies for targeted coverage improvements.
- Updated relevant instructions and agent files to enforce patch coverage requirements and improve validation processes.
- Add encryption key environment variable to docker-compose.yml,
docker-compose.dev.yml, docker-compose.local.yml, docker-compose.test.yml
- Update README.md Quick Start examples (compose and docker run)
- Include generation instructions: openssl rand -base64 32
Required for DNS provider and plugin features which encrypt sensitive data at rest.
- Updated package.json to include @types/node@25.0.3 for compatibility.
- Modified package-lock.json to reflect the new version of @types/node and updated cookie package to 1.1.1.
- Adjusted tsconfig.json to specify @testing-library/jest-dom/vitest for type definitions.
- Updated vite.config.ts to disable code splitting temporarily to diagnose React initialization issues, increasing chunk size warning limit.
- Add gotestsum for real-time test progress visibility
- Parallelize 174 tests across 14 files for faster execution
- Add -short mode support skipping 21 heavy integration tests
- Create testutil/db.go helper for future transaction rollbacks
- Fix data race in notification_service_test.go
- Fix 4 CrowdSec LAPI test failures with permissive validator
Performance improvements:
- Tests now run in parallel (174 tests with t.Parallel())
- Quick feedback loop via -short mode
- Zero race conditions detected
- Coverage maintained at 87.7%
Closes test optimization initiative
- Verify backend test coverage at 85.2% (threshold: 85%)
- Verify frontend test coverage at 87.8% (threshold: 85%)
- Add Google Cloud DNS setup guide
- Add Azure DNS setup guide
- Pass all security scans (Trivy, govulncheck)
- Pass all pre-commit hooks
- Updated UsersPage tests to check for specific URL formats instead of regex patterns.
- Increased timeout for Go coverage report generation to handle larger repositories.
- Cleaned up generated artifacts before running CodeQL analysis to reduce false positives.
- Removed outdated QA testing report for authentication fixes on the certificates page.
- Added final report confirming successful resolution of authentication issues with certificate endpoints.
- Deleted previous test output files to maintain a clean test results directory.
- Updated the QA/Security Validation Report with new dates and status.
- Enhanced coverage verification metrics for backend and frontend tests.
- Improved TypeScript checks and security scans, ensuring all checks passed.
- Refactored ProxyHosts tests to utilize mock implementations for hooks and APIs.
- Added smoke test for login functionality using Playwright.
- Adjusted vitest configuration to use thread pooling for tests.
- Removed unnecessary peer dependency from package-lock.json.
- Added comprehensive QA report for CodeQL CI alignment implementation, detailing tests, results, and findings.
- Created CodeQL security scanning guide in documentation, outlining usage and common issues.
- Developed pre-commit hooks for CodeQL scans and findings checks, ensuring security issues are identified before commits.
- Implemented scripts for running CodeQL Go and JavaScript scans, aligned with CI configurations.
- Verified all tests passed, including backend and frontend coverage, TypeScript checks, and SARIF file generation.
- Apply URL validation using security.ValidateWebhookURL() to all webhook
HTTP request paths in notification_service.go
- Block private IPs (RFC 1918), cloud metadata endpoints, and loopback
- Add comprehensive SSRF test coverage
- Add CodeQL VS Code tasks for local security scanning
- Update Definition of Done to include CodeQL scans
- Clean up stale SARIF files from repo root
Resolves CI security gate failure for CWE-918.
Enhance the Layout component with two critical UI/UX improvements:
1. Scrollable Sidebar Navigation:
- Add overflow-y-auto to navigation area between logo and logout
- Apply flex-shrink-0 to logout section to keep it anchored at bottom
- Add min-h-0 to enable proper flexbox shrinking
- Prevents logout button from being pushed off-screen when multiple
submenus are expanded
- Custom scrollbar styling for both light and dark themes
2. Fixed Header Bar:
- Change desktop header from relative to sticky positioning
- Header remains visible at top when scrolling main content
- Move overflow control from main container to content wrapper
- Proper z-index hierarchy maintained (header z-10, sidebar z-30)
- Mobile header behavior unchanged (already fixed)
Technical Details:
- Modified Layout.tsx: 7 targeted CSS class changes
- Modified index.css: Added WebKit and Firefox scrollbar styling
- CSS-only implementation (no JavaScript overhead)
- Hardware-accelerated scrolling for optimal performance
Testing:
- Frontend coverage: 87.59% (exceeds 85% threshold)
- Backend coverage: 86.2% (regression tested)
- Zero security vulnerabilities (Trivy scan)
- No accessibility regressions
- Cross-browser tested (Chrome, Firefox, Safari)
Breaking Changes: None
Backward Compatibility: Full
Files Changed:
- frontend/src/components/Layout.tsx
- frontend/src/index.css
Documentation:
- Updated CHANGELOG.md with UI enhancements
- Created comprehensive implementation summary
- Created detailed QA reports and manual test plan
