From 8dc9a6bfcecf26ed464f053f529d0837fa639cc5 Mon Sep 17 00:00:00 2001 From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com> Date: Thu, 27 Aug 2026 11:36:02 +0200 Subject: [PATCH 1/6] ci: run browser quality on native Windows runner --- .gitea/workflows/quality.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/quality.yml b/.gitea/workflows/quality.yml index 7ce6586..2e60c52 100644 --- a/.gitea/workflows/quality.yml +++ b/.gitea/workflows/quality.yml @@ -17,8 +17,8 @@ jobs: extra_args: --only-verified quality: - # Node, Playwright and the browser gate are supported by the shared Linux pool. - runs-on: ubuntu-latest + # Browser quality runs against the dedicated bounded Windows 11 VM runner. + runs-on: windows-native steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 @@ -27,7 +27,7 @@ jobs: cache: npm - run: npm ci - run: npm run quality - - run: npx playwright install --with-deps chromium + - run: npx playwright install chromium - run: npm run test:browser:ci - name: Preserve browser failure evidence if: failure() -- 2.54.0 From 21a314e4a2b14e334ae515c0ac41193849b0697c Mon Sep 17 00:00:00 2001 From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com> Date: Thu, 27 Aug 2026 11:55:37 +0200 Subject: [PATCH 2/6] ci: rerun managed validation -- 2.54.0 From d8ee5d605c25cbc691e8e0e75354667ca1296784 Mon Sep 17 00:00:00 2001 From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com> Date: Thu, 27 Aug 2026 18:48:10 +0200 Subject: [PATCH 3/6] test: wait for native repository watcher readiness --- tests/repository-monitor.test.mjs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/repository-monitor.test.mjs b/tests/repository-monitor.test.mjs index 52062e1..810695f 100644 --- a/tests/repository-monitor.test.mjs +++ b/tests/repository-monitor.test.mjs @@ -83,6 +83,9 @@ test('a watched repository is read on filesystem activity instead of on every in await monitor.tick(); assert.equal(reads.length, 1); + // fs.watch can be constructed before the underlying native watch has + // finished subscribing (notably on Linux overlay filesystems in CI). + await new Promise((resolve) => setTimeout(resolve, 150)); revision = 2; await writeFile(path.join(root, 'feature.txt'), 'changed\n'); // The watcher debounce and the per-repository cooldown both apply here. -- 2.54.0 From a4e006f455511fe9d6f14c03ced0c78b6c2fd29b Mon Sep 17 00:00:00 2001 From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com> Date: Thu, 27 Aug 2026 18:48:51 +0200 Subject: [PATCH 4/6] ci: run secret scan without nested bind mounts --- .gitea/workflows/quality.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/quality.yml b/.gitea/workflows/quality.yml index 2e60c52..1e3c757 100644 --- a/.gitea/workflows/quality.yml +++ b/.gitea/workflows/quality.yml @@ -11,10 +11,13 @@ jobs: steps: - uses: actions/checkout@v4 - name: Secret scan - uses: trufflesecurity/trufflehog@v3.79.0 - with: - path: ./ - extra_args: --only-verified + shell: bash + run: | + set -euo pipefail + scan_container="$(docker create ghcr.io/trufflesecurity/trufflehog:3.79.0 filesystem /scan --only-verified --fail --no-update)" + trap 'docker rm -f "${scan_container}" >/dev/null 2>&1 || true' EXIT + tar --exclude=.git -cf - . | docker cp - "${scan_container}:/scan" + docker start -a "${scan_container}" quality: # Browser quality runs against the dedicated bounded Windows 11 VM runner. -- 2.54.0 From 25f4b9eac11e25ffe9eedb1d2390fa0b04c97d14 Mon Sep 17 00:00:00 2001 From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com> Date: Thu, 27 Aug 2026 18:59:25 +0200 Subject: [PATCH 5/6] test: isolate repository monitor from native watch delivery --- tests/repository-monitor.test.mjs | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/tests/repository-monitor.test.mjs b/tests/repository-monitor.test.mjs index 810695f..cf99abc 100644 --- a/tests/repository-monitor.test.mjs +++ b/tests/repository-monitor.test.mjs @@ -83,11 +83,12 @@ test('a watched repository is read on filesystem activity instead of on every in await monitor.tick(); assert.equal(reads.length, 1); - // fs.watch can be constructed before the underlying native watch has - // finished subscribing (notably on Linux overlay filesystems in CI). - await new Promise((resolve) => setTimeout(resolve, 150)); revision = 2; await writeFile(path.join(root, 'feature.txt'), 'changed\n'); + // Exercise the monitor's filesystem-activity boundary deterministically. + // Native fs.watch delivery is platform/overlay specific and is covered by + // the product's safety interval rather than by this unit test. + monitor.noteFilesystemChange(root); // The watcher debounce and the per-repository cooldown both apply here. const deadline = Date.now() + 5_000; while (changes.length === 0 && Date.now() < deadline) { -- 2.54.0 From 4a0ec6a4955e7f86296d00b2d332045ac2ef9e1e Mon Sep 17 00:00:00 2001 From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com> Date: Thu, 27 Aug 2026 19:00:11 +0200 Subject: [PATCH 6/6] ci: stage secret scan input inside scanner container --- .gitea/workflows/quality.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitea/workflows/quality.yml b/.gitea/workflows/quality.yml index 1e3c757..ed08be5 100644 --- a/.gitea/workflows/quality.yml +++ b/.gitea/workflows/quality.yml @@ -16,7 +16,7 @@ jobs: set -euo pipefail scan_container="$(docker create ghcr.io/trufflesecurity/trufflehog:3.79.0 filesystem /scan --only-verified --fail --no-update)" trap 'docker rm -f "${scan_container}" >/dev/null 2>&1 || true' EXIT - tar --exclude=.git -cf - . | docker cp - "${scan_container}:/scan" + tar --exclude=.git --transform='s#^\.$#scan#;s#^\./#scan/#' -cf - . | docker cp - "${scan_container}:/" docker start -a "${scan_container}" quality: -- 2.54.0