Merge pull request #30 from WebDecoy/feat/i18n #39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Detection benchmark | |
| # Guards the per-signal false-positive budget against the committed corpus. | |
| # | |
| # The gate deliberately fails on only two things: a signal firing on the human | |
| # panel more often than its budget allows, and a replay error (an incomplete run | |
| # must not read as a pass). Aggregate FPR and per-class TPR are reported as | |
| # warnings — those are population claims and this corpus is not a population | |
| # sample, so gating on them would dress a regression check up as evidence about | |
| # real users. See bench/README.md. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| jobs: | |
| bench: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| - name: Install server dependencies | |
| working-directory: server-node | |
| run: npm install --no-audit --no-fund | |
| - name: Unit tests | |
| working-directory: server-node | |
| run: npm test | |
| - name: Start server | |
| working-directory: server-node | |
| run: | | |
| node server.js & | |
| for _ in $(seq 1 40); do | |
| curl -sf http://localhost:3000/health >/dev/null && exit 0 | |
| sleep 0.5 | |
| done | |
| echo "server did not come up"; exit 1 | |
| - name: End-to-end detection suite | |
| run: node test/test-detection.js | |
| # The widget in a real browser: the proof-of-work solver, and everything | |
| # about localization that is DOM-shaped rather than string-shaped (whether | |
| # <html lang> is consulted, whether dir="rtl" lands, whether the checkbox | |
| # resolves an accessible name). | |
| # | |
| # These existed but ran nowhere, so an assertion that a Playwright-driven | |
| # Chromium receives a token survived the shipping of the dispositive floor | |
| # that correctly stops exactly that. Untested tests rot quietly. | |
| - name: Install browser test dependencies | |
| working-directory: test/browser | |
| run: npm install --no-audit --no-fund | |
| - name: Install Chromium | |
| working-directory: test/browser | |
| run: npx playwright install --with-deps chromium | |
| - name: Browser suite | |
| working-directory: test/browser | |
| run: npm test | |
| # The harness itself, before it is trusted to measure anything. Sample | |
| # addresses have to stay unique or every per-source measurement is taken | |
| # against manufactured IP sharing. | |
| - name: Harness unit tests | |
| working-directory: bench | |
| run: npm test | |
| # Replays the committed corpus. No browser needed: capture is a separate, | |
| # manual step whose output lives in bench/corpus/. | |
| - name: Benchmark gate | |
| working-directory: bench | |
| run: node run-bench.js --gate --json bench-results.json | |
| - name: Upload results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: bench-results | |
| path: bench/bench-results.json | |
| if-no-files-found: ignore |