Skip to content
Draft
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions .github/workflows/integration-tests-nextjs.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
name: Next.js Integration Tests (downstream)

# Runs the @harperfast/nextjs adapter's Playwright integration suite against THIS
# PR's harper build, so a harper change that breaks the Next.js framework-hosting
# integration (HTTP server, REST, ISR/`use cache` backed by Harper tables) is
# caught here rather than in the downstream adapter repo.
#
# It calls the reusable workflow in HarperFast/nextjs, passing this PR's head SHA
# as `harper_ref`; the reusable workflow checks out + builds harper at that ref and
# resolves it as the `harper` the test harness and fixtures run against.
#
# Scoped to PRs that touch the HTTP / cache / resource / server code paths the
# adapter exercises (tune the paths filter as coverage evolves).
#
# ── BEFORE MERGE ───────────────────────────────────────────────────────────────
# 1. Depends on HarperFast/nextjs#49 — the `workflow_call` + `harper_ref` input
# must be on nextjs `main` first, or this caller has nothing to call.
# 2. Replace the mutable `@main` ref below with the 40-char merge-commit SHA of
# nextjs#49 (cross-repo reusable `uses:` should pin to a SHA, matching the
# convention in validate-caller-workflows.yml).

on:
pull_request:
paths:
- 'cache/**'
- 'resources/**'
- 'server/**'
- 'dataLayer/**'
- 'components/**'
- 'config/**'
- 'package.json'
- 'package-lock.json'

jobs:
nextjs-integration:
name: Next.js adapter integration (against this PR's harper)
uses: HarperFast/nextjs/.github/workflows/integration-tests.yml@main # TODO: pin to nextjs#49 merge SHA before merging

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blocker — mutable @main ref not caught by the repo's validator.

validate-caller-workflows.yml only covers claude-*.yml files, so this workflow bypasses the SHA-pinning check entirely. The @main ref means any push to HarperFast/nextjs main can silently change what CI code runs against harper PRs — an unguarded supply-chain injection vector.

The PR body already tracks this as a pre-merge TODO ("replace the mutable @main ref below with the 40-char merge-commit SHA of nextjs#49"). Do that before lifting the draft — this should not land with @main.

Suggested change
uses: HarperFast/nextjs/.github/workflows/integration-tests.yml@main # TODO: pin to nextjs#49 merge SHA before merging
uses: HarperFast/nextjs/.github/workflows/integration-tests.yml@<40-char-SHA-of-nextjs#49-merge-commit>

with:
harper_ref: ${{ github.event.pull_request.head.sha }}