diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d734ad2f0..c8e3f47ab 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -58,6 +58,9 @@ jobs: - name: Check UI ESLint, TypeScript, and Prettier Compliance run: yarn --cwd netbox/project-static validate + + - name: Validate Static Asset Integrity + run: scripts/verify-bundles.sh - name: Run tests run: coverage run --source="netbox/" netbox/manage.py test netbox/ diff --git a/docs/release-notes/version-3.0.md b/docs/release-notes/version-3.0.md index ac2ee021c..2389d6730 100644 --- a/docs/release-notes/version-3.0.md +++ b/docs/release-notes/version-3.0.md @@ -9,6 +9,7 @@ * [#7169](https://github.com/netbox-community/netbox/issues/7169) - Fix CSV import file upload * [#7176](https://github.com/netbox-community/netbox/issues/7176) - Fix issue where query parameters were duplicated across different forms of the same type * [#7193](https://github.com/netbox-community/netbox/issues/7193) - Fix prefix (flat) template issue when viewing child prefixes with prefixes available +* [#7202](https://github.com/netbox-community/netbox/issues/7202) - Verify integrity of static assets in CI --- diff --git a/scripts/verify-bundles.sh b/scripts/verify-bundles.sh new file mode 100755 index 000000000..e674de9bd --- /dev/null +++ b/scripts/verify-bundles.sh @@ -0,0 +1,41 @@ +#!/usr/bin/env bash + +# This script verifies the integrity of *bundled* static assets by re-running the bundling process +# and checking for changed files. Because bundle output should not change given the same source +# input, the bundle process shouldn't produce any changes. If they do, it's an indication that +# the dist files have been altered, or that dist files were not committed. In either case, tests +# should fail. + +PROJECT_STATIC="$PWD/netbox/project-static" +DIST="$PROJECT_STATIC/dist/" + +# Bundle static assets. +bundle() { + echo "Bundling static assets..." + yarn --cwd $PROJECT_STATIC bundle >/dev/null 2>&1 + if [[ $? != 0 ]]; then + echo "Error bundling static assets" + exit 1 + fi +} + +# See if any files have changed. +check_dist() { + local diff=$(git --no-pager diff $DIST) + if [[ $diff != "" ]]; then + local SHA=$(git rev-parse HEAD) + echo "Commit '$SHA' produced different static assets than were committed" + exit 1 + fi +} + +bundle +check_dist + +if [[ $? = 0 ]]; then + echo "Static asset check passed" + exit 0 +else + echo "Error checking static asset integrity" + exit 1 +fi