ci(web-wallet): nightly non-gating E2E workflow (#177 item 2c) - #179
ci(web-wallet): nightly non-gating E2E workflow (#177 item 2c)#179raul-oliveira wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthroughAdds a daily and manually triggered, non-gating GitHub Actions workflow for the web-wallet real-MetaMask Playwright E2E suite. It provisions Nix and Chromium, runs headed tests under xvfb, always uploads reports and test artifacts, and documents the workflow. ChangesNightly web-wallet E2E CI
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions as GitHub Actions
participant Nix as Nix environment
participant Xvfb as xvfb-run
participant Playwright
participant Artifacts as Uploaded artifacts
GitHubActions->>Nix: Install dependencies and build RPC handler
Nix->>Playwright: Install Chromium
GitHubActions->>Xvfb: Start virtual display
Xvfb->>Playwright: Run real-MetaMask E2E suite
Playwright->>Artifacts: Produce report, traces, and videos
GitHubActions->>Artifacts: Always upload outputs
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/e2e-web-wallet-nightly.yml:
- Around line 52-53: Update the “Install dependencies” step in the nightly
workflow to run Yarn with immutable lockfile enforcement, using the existing
yarn install command with the --immutable option. Preserve the current Nix
development-shell invocation while ensuring installation fails instead of
modifying or bypassing the committed lockfile.
- Around line 39-40: Update the actions/checkout@v4 step in the workflow to
disable credential persistence by setting persist-credentials to false, leaving
the checkout behavior and subsequent E2E steps unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: fd2b7a28-c4a6-491d-b1b9-bd3e75031f09
📒 Files selected for processing (3)
.github/workflows/e2e-web-wallet-nightly.ymldocs/superpowers/specs/2026-07-28-web-wallet-e2e-pr3-nightly-ci.mdpackages/web-wallet/tests/e2e/e2e.md
| - name: Checkout code | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
sed -n '1,140p' .github/workflows/e2e-web-wallet-nightly.yml
echo
echo "== checkout usages and git refs/triggers/actions in workflow =="
rg -n "actions/checkout|persist-credentials|git (fetch|clone|clone|add|push|submodule|config|lfs|push|fetch)|github\.|GITHUB_TOKEN|permissions|pull_request|workflows|packages" .github/workflows/e2e-web-wallet-nightly.ymlRepository: HathorNetwork/hathor-rpc-lib
Length of output: 4289
🌐 Web query:
actions/checkout v4 persist-credentials default true README
💡 Result:
In the actions/checkout action, the persist-credentials input has a default value of true [1][2][3]. When set to true (the default), the action automatically configures the repository's local git configuration with the provided token or SSH key [1][3]. This allows subsequent git commands (such as git fetch or git push) run within the same job to be authenticated automatically [4][3]. This token is removed during the post-job cleanup process [4][3]. To opt out of this behavior, you can explicitly set persist-credentials to false in your workflow file: - uses: actions/checkout@v4 with: persist-credentials: false Note that in newer versions (v6.0.0 and later), the implementation of this feature was updated to store credentials in a file under $RUNNER_TEMP rather than directly in the local.git/config file, which improves security [3][5][6].
Citations:
- 1: https://github.com/actions/checkout/blob/v4/action.yml
- 2: https://github.com/actions/checkout/blob/v4.1.1/action.yml
- 3: https://github.com/actions/checkout/?tab=readme-ov-file
- 4: https://github.com/actions/checkout/blob/v4/README.md
- 5: https://github.com/actions/checkout/tree/v6.0.0
- 6: actions/checkout@v5.0.1...v6.0.0
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== exact checkout line and next lines =="
nl -ba .github/workflows/e2e-web-wallet-nightly.yml | sed -n '35,43p'Repository: HathorNetwork/hathor-rpc-lib
Length of output: 247
🌐 Web query:
site:github.com/actions/checkout v4 persist-credentials default true README
💡 Result:
In the actions/checkout action, the persist-credentials input controls whether the authentication token (or SSH key) is configured in the local git repository's configuration [1][2]. As of the current version (v4), the default value for persist-credentials remains true [1][2]. When set to true, the action persists the credentials in the local git config, allowing subsequent steps in your workflow to execute authenticated git commands (e.g., git fetch, git push) [1][3]. These credentials are automatically removed during the post-job cleanup phase [1]. If you wish to opt out of this behavior for security reasons or because it is not required, you can explicitly set the input to false in your workflow YAML [1]: - name: Checkout uses: actions/checkout@v4 with: persist-credentials: false While there has been community discussion and proposed pull requests (such as PR #1687) to change this default to false to reduce the risk of credential exposure, the official action.yml and documentation for actions/checkout@v4 continue to list true as the default [1][2][4].
Citations:
- 1: https://github.com/actions/checkout/blob/v4/README.md
- 2: https://github.com/actions/checkout/blob/main/action.yml
- 3: https://github.com/actions/checkout/blob/master/adrs/0153-checkout-v2.md
- 4: Change the default value of persist-credentials to false actions/checkout#1687
Disable checkout credential persistence.
actions/checkout@v4 persists the read-only GITHUB_TOKEN in .git/config by default. This workflow’s remaining steps only install dependencies, build, install Playwright, and run/upload E2E artifacts, so authenticated Git commands are not needed.
Proposed fix
- name: Checkout code
uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 39-40: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-web-wallet-nightly.yml around lines 39 - 40, Update
the actions/checkout@v4 step in the workflow to disable credential persistence
by setting persist-credentials to false, leaving the checkout behavior and
subsequent E2E steps unchanged.
Source: Linters/SAST tools
| - name: Install dependencies | ||
| run: nix develop . -c yarn install |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files .github/workflows package.json yarn.lock | sed -n '1,120p'
echo
echo "== workflow context =="
if [ -f ".github/workflows/e2e-web-wallet-nightly.yml" ]; then
nl -ba .github/workflows/e2e-web-wallet-nightly.yml | sed -n '45,95p'
fi
echo
echo "== main workflow searches =="
rg -n "yarn install|immutable|e2e-web-wallet-nightly|nix develop.*yarn install" .github/workflows || true
echo
echo "== root package scripts =="
if [ -f package.json ]; then nl -ba package.json | sed -n '1,140p'; fi
echo
echo "== package manager metadata =="
if [ -f .yarnrc.yml ]; then nl -ba .yarnrc.yml | sed -n '1,160p'; fi
if [ -f corepack/package.json ]; then nl -ba corepack/package.json | sed -n '1,120p'; fi
echo
echo "== deterministic config probe =="
python3 - <<'PY'
import json, pathlib, re
p=pl.Path('.github/workflows/e2e-web-wallet-nightly.yml')
if not p.exists():
print("no nightly workflow")
else:
text=p.read_text()
for i,line in enumerate(text.splitlines(),1):
if 'yarn install' in line:
print(f"{i}: {line.strip()}")
PYRepository: HathorNetwork/hathor-rpc-lib
Length of output: 427
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== read workflow file =="
awk '{printf "%4d\t%s\n", NR, $0}' .github/workflows/e2e-web-wallet-nightly.yml
echo
echo "== compare workflows for yarn installation =="
python3 - <<'PY'
import pathlib, re
for path in pathlib.Path(".github/workflows").glob("*.yml"):
text = path.read_text()
print(f"\n## {path}")
for i, line in enumerate(text.splitlines(), 1):
if "yarn install" in line or "immutable" in line or re.search(r"yarn\s+(install|set-version|enable-corepack)", line):
print(f"{i}: {line}")
PY
echo
echo "== root package/config files =="
awk '{printf "%4d\t%s\n", NR, $0}' package.json
echo
if [ -f .yarnrc.yml ]; then awk '{printf "%4d\t%s\n", NR, $0}' .yarnrc.yml; else echo "no .yarnrc.yml"; fi
echo
echo "== lockfile first bytes =="
awk 'NR<=40 {printf "%4d\t%s\n", NR, $0}' yarn.lockRepository: HathorNetwork/hathor-rpc-lib
Length of output: 7291
Enforce the workspace lockfile during dependency installation.
Yarn 4’s plain yarn install can update stale/missing entries from package.json while leaving the lockfile behind; this nightly job then runs from a different dependency graph than the committed lockfile. Use an immutable install, e.g. yarn install --immutable, or change the workflow spec if non-locked installs are intentional.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-web-wallet-nightly.yml around lines 52 - 53, Update
the “Install dependencies” step in the nightly workflow to run Yarn with
immutable lockfile enforcement, using the existing yarn install command with the
--immutable option. Preserve the current Nix development-shell invocation while
ensuring installation fails instead of modifying or bypassing the committed
lockfile.
raul-oliveira
moved this from In Progress (Done)
to In Progress (WIP)
in Hathor Network
1 participant
Motivation
Nothing exercises the real-MetaMask web-wallet E2E suite in CI.
main.ymlruns on[push]andonly runs the lightweight smoke (
playwright test --project=chromium), neverplaywright.e2e.config.ts. So rot in the on-demand E2E infrastructure (e.g. a clean checkout nolonger being able to run the suite) goes unnoticed until someone runs it by hand.
This PR adds a scheduled, signal-only GitHub Actions workflow that runs the real-MetaMask-Flask
suite once a day (plus manual
workflow_dispatch) purely to surface that rot. The suite isexplicitly non-gating: a scheduled workflow never attaches as a PR status check, so it is
inherently non-gating, and it must additionally not be added to branch protection / required
checks. It reuses the Nix toolchain from
main.yml, boots a real headed Chromium under xvfb(MV3 extension loading needs a real display), and uploads the Playwright HTML report + traces +
videos as artifacts for triage.
This is PR 3 of the #177 follow-up sequence and closes item 2c of that issue.
Acceptance Criteria
.github/workflows/e2e-web-wallet-nightly.ymlruns the real-MetaMask suite viaplaywright test --config playwright.e2e.config.ts.schedule(06:00 UTC) and on manualworkflow_dispatch; it never runs per-PR.main.yml's toolchain: the same pinnedcachix/install-nix-actionSHA andDeterminateSystems/magic-nix-cache-action@v7, and the same plainnix develop . -c yarn installinvocation.yarn workspace @hathor/hathor-rpc-handler build) so it is self-sufficient regardless of the other PRs in the sequence.playwright install chromium --with-deps) and thexvfbapt package, and runs the suite headed underxvfb-run -a.E2E_FLASK_VERSION: '13.31.0',E2E_TIMEOUT_SCALE: '2', andE2E_PASSWORD: ${{ vars.E2E_PASSWORD || 'Hathor@123' }}; no PIN env var is wired (the suite never consumes one).if: always()so failures can be triaged.packages/web-wallet/tests/e2e/e2e.mdpoints at the nightly workflow as the CI signal.Notes / caveats
workflow_dispatchrun on GitHub. Local validation onlyproves the workflow is well-formed and its load-bearing steps resolve. Validated locally inside
nix develop: the YAML parses clean under@action-validator/cli;yarn install, the@hathor/hathor-rpc-handlerbuild, andplaywright install chromiumeach succeed; and everyuses:ref matchesmain.yml.import,feature-example, andtoken-lifecycleuse the committedpublic
fundedtestnet stub seed and pass only while that testnet address holds balance. On a drywallet they fail at their first funded step — acceptable for a non-gating signal run. If the team
later wants an always-green signal, a follow-up can restrict the schedule to
--project=onboarding(dry); the full matrix is kept here deliberately.
Checklist
master, confirm this code is production-ready and can be included in future releases as soon as it gets mergedSummary by CodeRabbit
Tests
Documentation