chore: add CI/CD security regression tests #22

New issue

Open

opened 2026-02-21 01:03:04 +00:00 by Clotho · 0 comments

Clotho commented

2026-02-21 01:03:04 +00:00

Member

Summary

There are no CI/CD pipeline checks to prevent security regressions. SQL injection prevention, workspace isolation, and quota enforcement should fail CI if broken.

Problem

Code changes could weaken SQL validation without automated detection
No automated check that workspace isolation is enforced
Security fixes could be accidentally reverted

Proposed Solution

Add a GitHub Actions / CI workflow:

Run ./vendor/bin/pest tests/Unit/SqlQueryValidatorTest.php as a required check
Run workspace context security tests
Add a dedicated pest --group=security tag to security-critical tests
Fail CI if any security test fails

Files

.github/workflows/security.yml (create) or equivalent CI config
Tag existing security tests with @group security

Notes

Also noted in TODO.md under Infrastructure.

## Summary There are no CI/CD pipeline checks to prevent security regressions. SQL injection prevention, workspace isolation, and quota enforcement should fail CI if broken. ## Problem - Code changes could weaken SQL validation without automated detection - No automated check that workspace isolation is enforced - Security fixes could be accidentally reverted ## Proposed Solution Add a GitHub Actions / CI workflow: - Run `./vendor/bin/pest tests/Unit/SqlQueryValidatorTest.php` as a required check - Run workspace context security tests - Add a dedicated `pest --group=security` tag to security-critical tests - Fail CI if any security test fails ## Files - `.github/workflows/security.yml` (create) or equivalent CI config - Tag existing security tests with `@group security` ## Notes Also noted in TODO.md under Infrastructure.