Repository navigation
ci: Reproduzierbare .NET-, Angular-, PostgreSQL- und Keycloak-Prüfungen - #5
Merged
Merged
Conversation
…k bootstrap Apply existing .NET/PostgreSQL/Angular/Playwright/Keycloak test coverage as one clean change without importing abandoned branch commits. A temporary trusted-branch-only workflow commits *actual resolved* dependency locks, then is removed before merge. No deployments or production credentials.
Require actual committed NuGet packages.lock.json and npm package-lock.json; use dotnet restore --locked-mode and npm ci in all standard CI builds. Remove one-off contents:write dependency bootstrap workflow, reduce artifact scope, and document verification boundaries. Do not deploy or publish.
Build ASP.NET API and Angular inside the production multi-stage Dockerfile using only locked npm/NuGet dependencies; assert backend/frontend assets and non-root runtime. Make the final summary fail when any required test job fails, skips or is cancelled. No deploy, registry push or production secrets.
…ries With two delegated service accounts test that client-level permissions alone do not authorize user/group mapping; permit only explicit target user/group, deny foreign roles, unrelated recipients and account mutations; verify delegated revocation and remote state. Isolated test realm only.
Keycloak correctly rejects duplicate email addresses within a test realm; generate a distinct invalid-domain address for each ephemeral test user.
Use official GitHub release commits instead of mutable action tags and cache npm by its committed lockfile. Bound retries for observed ECONNRESET. Document real positive and negative user/group FGAP v2 role mapping tests and their remaining security boundaries.
Record verified GitHub Actions run 38946163282 with 102 xUnit/PostgreSQL, 32 TypeScript, 8 Playwright, Docker, dependency locks and delegated Keycloak target user/group positive and negative scenarios. Retain clear external LDAP, production OIDC/MFA, SBOM and recovery gaps.
27 of 37 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Umfang
main, Pushes aufmainund manuelle Auslösung.npm audit --omit=dev --audit-level=high.dotnet restore --locked-modeundnpm ci; separater Reproduzierbarkeits-Gate.CI- und Supply-Chain-Schutz
Nur Standard-GitHub-Runner,
permissions: contents: read,pull_requestnichtpull_request_target,checkout persist-credentials: false; keine produktiven Secrets, keine Deployments, keine Veröffentlichungen. Kurzzeitig für echte Lockfile-Generierung verwendeter vertrauenswürdiger, branchgebundener Workflow mitcontents: writewurde vollständig aus dem finalen Tree entfernt. Nachfolgende Branch-Commits sindnoreply-Identitäten; der ältere geschlossene CI-PR wurde nicht als Commit-Historie übernommen.Tatsächliche Nachweise und Abgrenzungen
Frühere CI-Läufe: bis auf fehlende Lockfiles waren sämtliche Build-/Testjobs grün, darunter 102/102 xUnit inkl. PostgreSQL, Angular-Produktion, Playwright, Keycloak-FGAP-Client-Isolation. Der neue PR muss mit den eingecheckten Locks erneut vollständig durchlaufen. Das fehlende ursprünglich rote Lockfile-Gate wurde auf Dateiebene behoben.
Noch offen: vollständige delegierte FGAP-Zielbenutzer-/Gruppenzuweisungsmatrix, produktiver BFF-OIDC/MFA-Test, LDAP/AD-Änderungsereignisse, SBOM/transitive Lizenzprüfung, Hochverfügbarkeit, Disaster Recovery, Last- und Penetrationstests. Ein grüner CI-Lauf ist keine Produktionsfreigabe.
Tracking: #3. Details:
docs/ci.md,docs/evidence/ci-2026-10-16.md,docs/roadmap.md.