test

.github/workflows/be-test-report.yml

@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v2
       - name: 📁 Download test results
         id: download-artifact
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@v6
         with:
           name: be-test-results
           path: backend

.github/workflows/check-be-ts-and-lint.yml

@@ -10,26 +10,64 @@ on:
       - "backend/.eslintrc.js"
 
 jobs:
-  check-be-pr:
-    name: Check TS and Lint
+  type-check:
+    name: Type Check
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
       - name: ☁️ Checkout source
-        uses: actions/checkout@v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: 🔧 Setup Node 22
-        uses: actions/setup-node@v3
+        id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
-          cache: "npm"
-          cache-dependency-path: backend/package-lock.json
+      - name: 📦 Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: backend/node_modules
+          key: backend-node-modules-${{ runner.os }}-node${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('backend/package-lock.json') }}
       - name: Install dependencies
-        run: npm install
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
         working-directory: backend
+      - name: 📦 Cache tsbuildinfo
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: backend/.cache/tsconfig.tsbuildinfo
+          key: backend-tsbuildinfo-${{ github.ref }}-${{ github.sha }}
+          restore-keys: |
+            backend-tsbuildinfo-${{ github.ref }}-
+            backend-tsbuildinfo-
       - name: Run type check
         run: npm run type:check
         working-directory: backend
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: ☁️ Checkout source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: 🔧 Setup Node 22
+        id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "22"
+      - name: 📦 Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: backend/node_modules
+          key: backend-node-modules-${{ runner.os }}-node${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('backend/package-lock.json') }}
+      - name: Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
+        working-directory: backend
       - name: Run lint check
         run: npm run lint
         working-directory: backend

.github/workflows/check-fe-ts-and-lint.yml

@@ -10,26 +10,64 @@ on:
       - "frontend/.eslintrc.js"
 
 jobs:
-  check-fe-ts-lint:
-    name: Check Frontend Type and Lint check
+  type-check:
+    name: Type Check
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
       - name: ☁️ Checkout source
-        uses: actions/checkout@v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: 🔧 Setup Node 22
-        uses: actions/setup-node@v3
+        id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
+      - name: 📦 Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: frontend/node_modules
+          key: frontend-node-modules-${{ runner.os }}-node${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('frontend/package-lock.json') }}
       - name: 📦 Install dependencies
-        run: npm install
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
         working-directory: frontend
+      - name: 📦 Cache tsbuildinfo
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: frontend/.cache/tsconfig.app.tsbuildinfo
+          key: frontend-tsbuildinfo-${{ github.ref }}-${{ github.sha }}
+          restore-keys: |
+            frontend-tsbuildinfo-${{ github.ref }}-
+            frontend-tsbuildinfo-
       - name: 🏗️ Run Type check
         run: npm run type:check
         working-directory: frontend
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: ☁️ Checkout source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: 🔧 Setup Node 22
+        id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "22"
+      - name: 📦 Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: frontend/node_modules
+          key: frontend-node-modules-${{ runner.os }}-node${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('frontend/package-lock.json') }}
+      - name: 📦 Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
+        working-directory: frontend
       - name: 🏗️ Run Lint check
         run: npm run lint
         working-directory: frontend

.github/workflows/release-standalone-docker-img-postgres-offical.yml

@@ -21,7 +21,7 @@ jobs:
               id: extract_version
               run: echo "::set-output name=version::${GITHUB_REF_NAME}"
             - name: ☁️ Checkout source
-              uses: actions/checkout@v3
+              uses: actions/checkout@v4
               with:
                   fetch-depth: 0
             - name: 📦 Install dependencies to test all dependencies
@@ -39,9 +39,9 @@ jobs:
               id: commit
               uses: pr-mpt/actions-commit-hash@v2
             - name: 🔧 Set up Docker Buildx
-              uses: docker/setup-buildx-action@v2
+              uses: docker/setup-buildx-action@v3
             - name: 🐋 Login to Docker Hub
-              uses: docker/login-action@v2
+              uses: docker/login-action@v3
               with:
                   username: ${{ secrets.DOCKERHUB_USERNAME }}
                   password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -84,7 +84,7 @@ jobs:
               id: extract_version
               run: echo "::set-output name=version::${GITHUB_REF_NAME}"
             - name: ☁️ Checkout source
-              uses: actions/checkout@v3
+              uses: actions/checkout@v4
               with:
                   fetch-depth: 0
             - name: 📦 Install dependencies to test all dependencies
@@ -102,9 +102,9 @@ jobs:
               id: commit
               uses: pr-mpt/actions-commit-hash@v2
             - name: 🔧 Set up Docker Buildx
-              uses: docker/setup-buildx-action@v2
+              uses: docker/setup-buildx-action@v3
             - name: 🐋 Login to Docker Hub
-              uses: docker/login-action@v2
+              uses: docker/login-action@v3
               with:
                   username: ${{ secrets.DOCKERHUB_USERNAME }}
                   password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/run-backend-bdd-tests.yml

@@ -25,7 +25,7 @@ jobs:
           docker system prune -af
 
       - name: ☁️ Checkout source
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Install uv
         uses: astral-sh/setup-uv@v5
       - name: Install Python
@@ -36,11 +36,10 @@ jobs:
         with:
           version: "2.14.2"
       - name: 🔧 Setup Node 22
-        uses: actions/setup-node@v3
+        id: setup-node
+        uses: actions/setup-node@v4
         with:
           node-version: "22"
-          cache: "npm"
-          cache-dependency-path: backend/package-lock.json
       - name: Setup Python 3.11
         uses: actions/setup-python@v5
         with:
@@ -52,8 +51,15 @@ jobs:
           cmake -S /tmp/sscep-build -B /tmp/sscep-build/build
           make -C /tmp/sscep-build/build -j$(nproc)
           sudo cp /tmp/sscep-build/build/sscep /usr/local/bin/sscep
+      - name: 📦 Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@v4
+        with:
+          path: backend/node_modules
+          key: backend-node-modules-${{ runner.os }}-node${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('backend/package-lock.json') }}
       - name: Install dependencies
-        run: npm install
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
         working-directory: backend
 
       - name: Output .env file and enable feature flags for BDD tests

.github/workflows/run-backend-tests.yml

@@ -14,7 +14,7 @@ jobs:
   check-be-pr:
     name: Run integration test
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 45
     steps:
       - name: Free up disk space
         run: |
@@ -25,20 +25,26 @@ jobs:
           docker system prune -af
 
       - name: ☁️ Checkout source
-        uses: actions/checkout@v3
-      - uses: KengoTODA/actions-setup-docker-compose@v1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: KengoTODA/actions-setup-docker-compose@477353946803dd64eaa44008b865b6bfc88cab4e # v1.2.4
         if: ${{ env.ACT }}
         name: Install `docker compose` for local simulations
         with:
           version: "2.14.2"
       - name: 🔧 Setup Node 22
-        uses: actions/setup-node@v3
+        id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
-          cache: "npm"
-          cache-dependency-path: backend/package-lock.json
+      - name: 📦 Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: backend/node_modules
+          key: backend-node-modules-${{ runner.os }}-node${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('backend/package-lock.json') }}
       - name: Install dependencies
-        run: npm install
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
         working-directory: backend
       - name: Start postgres and redis
         run: touch .env && docker compose -f docker-compose.dev.yml up -d db redis
@@ -47,18 +53,32 @@ jobs:
       - name: Run unit test
         run: npm run test:unit
         working-directory: backend
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      - name: Build FIPS test image
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: backend
+          file: backend/Dockerfile.dev.fips
+          load: true
+          tags: infisical-backend-fips:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
       - name: Run integration test
-        run: npm run test:e2e
-        working-directory: backend
-        env:
-          E2E_TEST_ORACLE_DB_19_HOST: ${{ secrets.E2E_TEST_ORACLE_DB_19_HOST }}
-          E2E_TEST_ORACLE_DB_19_USERNAME: ${{ secrets.E2E_TEST_ORACLE_DB_19_USERNAME }}
-          E2E_TEST_ORACLE_DB_19_PASSWORD: ${{ secrets.E2E_TEST_ORACLE_DB_19_PASSWORD }}
-          E2E_TEST_ORACLE_DB_19_DATABASE: ${{ secrets.E2E_TEST_ORACLE_DB_19_DATABASE }}
-          REDIS_URL: redis://172.17.0.1:6379
-          DB_CONNECTION_URI: postgres://infisical:infisical@172.17.0.1:5432/infisical?sslmode=disable
-          AUTH_SECRET: something-random
-          ENCRYPTION_KEY: 4bnfe4e407b8921c104518903515b218
+        run: |
+          docker run --rm --network host \
+            -e DB_CONNECTION_URI="postgres://infisical:infisical@localhost:5432/infisical?sslmode=disable" \
+            -e REDIS_URL="redis://localhost:6379" \
+            -e AUTH_SECRET="something-random" \
+            -e ENCRYPTION_KEY="p5e5k2j3+HIErjm02dzSrlhXc1xhdgoWvC6pox410rE=" \
+            -e NODE_ENV="test" \
+            -e NODE_OPTIONS="--force-fips" \
+            -e E2E_TEST_ORACLE_DB_19_HOST="${{ secrets.E2E_TEST_ORACLE_DB_19_HOST }}" \
+            -e E2E_TEST_ORACLE_DB_19_USERNAME="${{ secrets.E2E_TEST_ORACLE_DB_19_USERNAME }}" \
+            -e E2E_TEST_ORACLE_DB_19_PASSWORD="${{ secrets.E2E_TEST_ORACLE_DB_19_PASSWORD }}" \
+            -e E2E_TEST_ORACLE_DB_19_DATABASE="${{ secrets.E2E_TEST_ORACLE_DB_19_DATABASE }}" \
+            infisical-backend-fips:latest \
+            npm run test:e2e
       - name: cleanup
         run: |
           docker compose -f "docker-compose.dev.yml" down