Maximilian Stubhan
8d978981b0
Positions
- Removed the "Besetzen" action, the StaffInternallyModal behind it and the
now-unreachable staffPositionInternally server action: a position is filled
through the hire process, not from the positions list. Note that
transfer_employee has no position_id at all and never touched `positions`,
so with staff_position_internally out of the UI, hire_employee is the only
thing that closes a position — a transfer into an open one leaves it open.
The RPC itself is still in the database and still covered by its tests.
SVNR
- Austrian social security numbers are now validated: ten digits, weighted
check digit mod 11, and the TTMMJJ tail cross-checked against birth_date,
which is what catches a transposed date that a valid check digit would let
through. A serial whose weighted sum lands on 11 is rejected rather than
wrapped — those are never issued.
- Applies to Austrian locations only; the German/Czech/Slovenian equivalents
have their own formats and stay free-form.
- Enforced by a trigger, not inside hire_employee/change_employee_data, for
the same reason as the assignment history: both have been redefined by
half a dozen migrations. Only a *newly written* value is checked, so a
legacy number never blocks an unrelated transfer or address change.
- The seed drew a random four-digit prefix, so its check digit was right
only by chance and every seeded Austrian row would now be rejected;
it computes the check digit properly now.
Tech stack
- next 16.2.11 closes nine advisories against 16.2.10, including a
middleware/proxy bypass in App Router apps on Turbopack — proxy.ts is this
app's entry gate. RLS remains the real boundary, so the blast radius was a
blank page rather than data, but it is a patch-level fix. Also react
19.2.8, tailwind 4.3.3, lucide-react 1.26, supabase-js/ssr, postcss.
- CI runs lint, typecheck, schema/type drift, tests and build; a second job
replays every migration onto an empty database and runs the integration
suite against it, so a migration that cannot be replayed from scratch
fails here instead of during a restore.
- scripts/check-schema-types.mjs diffs the hand-written lib/supabase/types.ts
against the migrations. Reading the SQL rather than a live database keeps
Postgres out of the fast CI job. Verified in both directions.
- vitest now runs two projects: node for logic, jsdom for components. The
first component test covers the org chart expand control, which broke
earlier this session when elementsSelectable={false} made React Flow
compute pointer-events:none for the whole node; re-introducing that prop
fails three of these tests.
- Content-Security-Policy is emitted report-only. Enforcing a policy derived
from inspection rather than from violation reports risks blanking the app;
'unsafe-inline' on script-src is required until a nonce is threaded through
proxy.ts, which is a separate change.
- Fixed supabase/seed.ts, which this session's SVNR change had broken: the
extensionless "../lib/svnr" import does not resolve under Node's ESM
loader, so the seed failed at startup.
- engines pinned to node >=22 <25, tsconfig target ES2022, and the dead
test:e2e script removed (no Playwright is installed).
91 lines
2.5 KiB
YAML
91 lines
2.5 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [master, main]
|
|
pull_request:
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
check:
|
|
name: Lint, Typen, Tests, Build
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
|
|
- run: npm ci
|
|
|
|
- name: Lint
|
|
run: npm run lint
|
|
|
|
- name: Typecheck
|
|
run: npm run typecheck
|
|
|
|
# Catches the drift that `tsc` cannot: lib/supabase/types.ts is
|
|
# hand-written, so a migration adding a column leaves it silently stale.
|
|
- name: Schema/Typen-Abgleich
|
|
run: npm run types:check
|
|
|
|
- name: Unit- und Komponententests
|
|
run: npm test
|
|
|
|
- name: Build
|
|
run: npm run build
|
|
env:
|
|
# Read at module scope by the Supabase browser client, so the build
|
|
# needs them present — never the real project's values.
|
|
NEXT_PUBLIC_SUPABASE_URL: http://127.0.0.1:54321
|
|
NEXT_PUBLIC_SUPABASE_ANON_KEY: build-time-placeholder
|
|
|
|
integration:
|
|
name: Integrationstests (echtes Postgres)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
|
|
- run: npm ci
|
|
|
|
- uses: supabase/setup-cli@v1
|
|
with:
|
|
version: latest
|
|
|
|
# Applies every migration to a fresh database — which also means a
|
|
# migration that cannot be replayed from scratch fails here rather than
|
|
# on a restore or a new environment.
|
|
- name: Supabase starten
|
|
run: supabase start
|
|
|
|
# `-o env` emits API_URL / ANON_KEY / SERVICE_ROLE_KEY; the app expects
|
|
# them under its own names.
|
|
- name: Testumgebung schreiben
|
|
run: |
|
|
supabase status -o env \
|
|
--override-name api.url=NEXT_PUBLIC_SUPABASE_URL \
|
|
--override-name auth.anon_key=NEXT_PUBLIC_SUPABASE_ANON_KEY \
|
|
--override-name auth.service_role_key=SUPABASE_SERVICE_ROLE_KEY \
|
|
| grep -E '^(NEXT_PUBLIC_SUPABASE_URL|NEXT_PUBLIC_SUPABASE_ANON_KEY|SUPABASE_SERVICE_ROLE_KEY)=' \
|
|
| tr -d '"' > .env.test.local
|
|
|
|
- name: Seed
|
|
run: node --env-file=.env.test.local supabase/seed.ts
|
|
|
|
- name: Integrationstests
|
|
run: npm run test:integration
|
|
|
|
- name: Supabase-Logs bei Fehlschlag
|
|
if: failure()
|
|
run: supabase status && docker ps -a
|