test: add security CI and internal coverage

.github/workflows/ci.yml

@@ -0,0 +1,126 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - master
+      - main
+  pull_request:
+    branches:
+      - master
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  relay:
+    name: Relay tests and coverage
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: relay
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.0.0
+
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version-file: relay/go.mod
+          cache: true
+
+      - name: Download Go dependencies
+        run: go mod download
+
+      - name: Run Go tests with coverage
+        run: go test -covermode=atomic -coverprofile=coverage.out ./...
+
+      - name: Upload Go coverage
+        uses: actions/upload-artifact@v4.6.2
+        with:
+          name: relay-coverage
+          path: relay/coverage.out
+          if-no-files-found: error
+
+  blossom:
+    name: Blossom tests and build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: blossom
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.0.0
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.0.0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: blossom/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run Blossom rules tests
+        run: node --test src/rules/index.test.mjs
+
+      - name: Build Blossom and admin application
+        run: pnpm build
+
+  dashboard:
+    name: Dashboard JavaScript syntax
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.0.0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+
+      - name: Check dashboard JavaScript syntax
+        run: node --check relay/web/static/script.js
+
+  nip-coverage:
+    name: Validate NIP coverage matrix
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: relay
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.0.0
+
+      - name: Validate NIP coverage data
+        shell: bash
+        run: |
+          set -euo pipefail
+          matrix=tests/nips/coverage.tsv
+          test -s "$matrix"
+          awk -F '\t' '
+            $1 ~ /^#/ { next }
+            NF < 5 || $1 !~ /^NIP-[0-9A-Z]+$/ || ($3 != "integration" && $3 != "contract" && $3 != "manual" && $3 != "external") {
+              print "invalid NIP coverage row " NR ": " $0 > "/dev/stderr"
+              exit 1
+            }
+            END {
+              if (NR < 1) {
+                print "coverage.tsv contains no NIP entries" > "/dev/stderr"
+                exit 1
+              }
+            }
+          ' "$matrix"
+
+          test -x tests/nips/run_all.sh
+          test -x tests/nips/run_coverage.sh

blossom/admin/package.json

@@ -28,5 +28,10 @@
     "prettier": "^3.9.6",
     "typescript": "^7.0.2",
     "vite": "^8.2.2"
+  },
+  "pnpm": {
+    "overrides": {
+      "decode-uri-component": "^0.5.0"
+    }
   }
 }

blossom/admin/pnpm-workspace.yaml

@@ -0,0 +1,3 @@
+packages: []
+overrides:
+  decode-uri-component: ^0.5.0

blossom/package.json

@@ -46,7 +46,7 @@
     "mkdirp": "^3.0.1",
     "nanoid": "^6.0.1",
     "nostr-tools": "^2.24.3",
-    "sharp": "^0.35.3",
+    "sharp": "^0.35.4",
     "socks-proxy-agent": "^10.1.0",
     "ws": "^8.21.3",
     "yaml": "^2.9.0"
@@ -74,5 +74,16 @@
     "prettier": "^3.9.6",
     "typescript": "^7.0.2"
   },
-  "packageManager": "pnpm@9.12.0"
+  "packageManager": "pnpm@9.12.0",
+  "pnpm": {
+    "overrides": {
+      "qs": "^6.16.0",
+      "decode-uri-component": "^0.5.0",
+      "stream-json": "^3.5.0"
+    },
+    "patchedDependencies": {
+      "minio@8.0.7": "patches/minio@8.0.7.patch",
+      "stream-json@3.6.0": "patches/stream-json@3.6.0.patch"
+    }
+  }
 }

blossom/patches/minio@8.0.7.patch

@@ -0,0 +1,39 @@
+diff --git a/dist/esm/notification.mjs b/dist/esm/notification.mjs
+index 2fe075b73a9f98ece945993ebc151f601e0d52ee..b6b2b6a60f3b2e699a351540bd9f6aa8259b2e33 100644
+--- a/dist/esm/notification.mjs
++++ b/dist/esm/notification.mjs
+@@ -15,7 +15,7 @@
+  */
+ 
+ import { EventEmitter } from 'eventemitter3';
+-import jsonLineParser from 'stream-json/jsonl/Parser.js';
++import jsonLineParser from 'stream-json/jsonl/parser.js';
+ import { DEFAULT_REGION } from "./helpers.mjs";
+ import { pipesetup, uriEscape } from "./internal/helper.mjs";
+ 
+diff --git a/dist/main/notification.js b/dist/main/notification.js
+index 8d8e8b389bc313de072c603b302e4c39d373d345..84abcb1b303e5e8e648b56cfbfb20c54b696bf31 100644
+--- a/dist/main/notification.js
++++ b/dist/main/notification.js
+@@ -4,7 +4,7 @@ Object.defineProperty(exports, "__esModule", {
+   value: true
+ });
+ var _eventemitter = require("eventemitter3");
+-var _Parser = require("stream-json/jsonl/Parser.js");
++var _Parser = require("stream-json/jsonl/parser.js");
+ var _helpers = require("./helpers.js");
+ var _helper = require("./internal/helper.js");
+ /*
+diff --git a/src/notification.ts b/src/notification.ts
+index 64c24112d225a234d3b5acf06043020e9fe414af..debce83dc4708745137abc4eb45218a7c7d40f0c 100644
+--- a/src/notification.ts
++++ b/src/notification.ts
+@@ -15,7 +15,7 @@
+  */
+ 
+ import { EventEmitter } from 'eventemitter3'
+-import jsonLineParser from 'stream-json/jsonl/Parser.js'
++import jsonLineParser from 'stream-json/jsonl/parser.js'
+ 
+ import { DEFAULT_REGION } from './helpers.ts'
+ import type { TypedClient } from './internal/client.ts'

blossom/patches/stream-json@3.6.0.patch

@@ -0,0 +1,7 @@
+diff --git a/src/jsonl/Parser.js b/src/jsonl/Parser.js
+new file mode 100644
+index 0000000000000000000000000000000000000000..84d579544cf1c21bba8fbaab5465eac1c1175f86
+--- /dev/null
++++ b/src/jsonl/Parser.js
+@@ -0,0 +1 @@
++export { default } from "./parser.js";