From cca249e517a1bff214d835f00ca8eceaa3b83304 Mon Sep 17 00:00:00 2001 From: Zachary Lowden Date: Sat, 13 Jun 2026 17:09:46 -0500 Subject: [PATCH] ci(lighthouse): report-only Lighthouse CI on PR previews (Tekton) (#2516) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * ci(lighthouse): report-only Lighthouse CI on PR previews (Tekton) Adds the civitai-side config for a new report-only `lighthouse` task in the datapacket-talos pr-preview pipeline. On each preview build it runs Lighthouse (5 runs, desktop, median-aggregated) against the deployed preview at pr-.civitaic.com and posts a report-only PR comment with perf/a11y scores + LCP/CLS/TBT/INP and a public report link. - lighthouserc.json: 3 routes (/ /models /generate), numberOfRuns 5, desktop preset, --no-sandbox, temporary-public-storage upload. All assertions are `warn` (report-only) — promotion path documented (deterministic CLS/byte budgets to `error` first, noisy timing metrics last, after a soak). - tests/lighthouse-mint-cookie.cjs: mints the gate-passing ci-smoke-gold NextAuth session cookie (same next-auth/jwt encode + NEXTAUTH_SECRET as tests/preview-auth.setup.ts) and injects it into collect.settings.extraHeaders -> lighthouserc.runtime.json, so headless Chrome clears the preview-auth middleware /login gate instead of measuring the login page. Report-only first; structured to flip to gating later. Co-Authored-By: Claude Opus 4.8 (1M context) * ci: retrigger preview for lighthouse upload fix * ci: retrigger preview for lighthouse manifest fix --------- Co-authored-by: Claude Opus 4.8 (1M context) --- .gitignore | 4 ++ lighthouserc.json | 30 +++++++++++ tests/lighthouse-mint-cookie.cjs | 85 ++++++++++++++++++++++++++++++++ 3 files changed, 119 insertions(+) create mode 100644 lighthouserc.json create mode 100644 tests/lighthouse-mint-cookie.cjs diff --git a/.gitignore b/.gitignore index 1ba0f592ee..dd44157c20 100644 --- a/.gitignore +++ b/.gitignore @@ -134,3 +134,7 @@ tmpclaude-* # Turborepo local task cache .turbo/ + +# Lighthouse CI — runtime config (cookie-injected) + report output, never committed +lighthouserc.runtime.json +.lighthouseci/ diff --git a/lighthouserc.json b/lighthouserc.json new file mode 100644 index 0000000000..947cc66bfc --- /dev/null +++ b/lighthouserc.json @@ -0,0 +1,30 @@ +{ + "//": "Lighthouse CI config for the PR-preview pipeline (datapacket-talos pr-preview-pipeline.yaml `lighthouse` task). REPORT-ONLY: no assertions are set to `error`, so a regression never fails the build. The Tekton task mints a gold-tester NextAuth session cookie (the preview is gated by preview-auth.middleware -> unauthenticated requests 302 to /login) and injects it into collect.settings.extraHeaders at runtime, producing lighthouserc.runtime.json from this base. See tests/lighthouse-mint-cookie.cjs.", + "ci": { + "collect": { + "//": "5 runs + LHCI median aggregation is the single biggest stabilizer on a capacity-constrained build pool — lab noise is real, which is exactly why this is report-only and why timing metrics (LCP/TBT/INP) must NOT be promoted to a gating assertion until a soak proves the threshold sits above the noise band. URLs are filled in per-PR by the task (BASE_URL + these paths). All routes are hit AUTHENTICATED as ci-smoke-gold (a gate-passing paid member) — an anonymous GET would 302 to /login and measure the login page, not the app.", + "numberOfRuns": 5, + "settings": { + "preset": "desktop", + "//preset": "Desktop preset (not mobile). Desktop is the lower-variance profile on a noisy shared runner and matches the primary civitai surface; revisit mobile once the desktop signal is trusted.", + "chromeFlags": "--no-sandbox --disable-gpu --disable-dev-shm-usage --headless=new", + "//chromeFlags": "--no-sandbox is required: the Tekton step runs Chrome without the kernel sandbox privileges. --disable-dev-shm-usage avoids /dev/shm exhaustion in the small container.", + "maxWaitForLoad": 60000 + } + }, + "assert": { + "//": "REPORT-ONLY. Every assertion is `warn` — LHCI surfaces the diff but exits 0, so the build never fails. Promotion path (mirrors the bundle-budget soak->gate philosophy): promote the DETERMINISTIC, low-variance metrics to `error` FIRST once a soak confirms a stable baseline — cumulative-layout-shift (geometry, near-zero variance) and total byte/resource budgets. Promote the NOISY timing metrics (largest-contentful-paint, total-blocking-time, interactive, interaction-to-next-paint) LAST, and only with a threshold set comfortably above the observed 5-run noise band. To gate: change the relevant `warn` to `error`.", + "assertions": { + "categories:performance": ["warn", { "minScore": 0.5 }], + "categories:accessibility": ["warn", { "minScore": 0.9 }], + "cumulative-layout-shift": ["warn", { "maxNumericValue": 0.1 }], + "largest-contentful-paint": ["warn", { "maxNumericValue": 4000 }], + "total-blocking-time": ["warn", { "maxNumericValue": 600 }] + } + }, + "upload": { + "//": "temporary-public-storage gives a public, 7-day report URL with zero infra (no @lhci/server stood up). The task ALSO reads .lighthouseci/manifest.json (median-run summary scores) and the representative lhr-*.json (LCP/CLS/TBT/INP audits) for the PR comment, and .lighthouseci/links.json for the public URLs.", + "target": "temporary-public-storage" + } + } +} diff --git a/tests/lighthouse-mint-cookie.cjs b/tests/lighthouse-mint-cookie.cjs new file mode 100644 index 0000000000..2e2e82bf37 --- /dev/null +++ b/tests/lighthouse-mint-cookie.cjs @@ -0,0 +1,85 @@ +#!/usr/bin/env node +/** + * Mint a gate-passing NextAuth session cookie for a deployed PR preview and + * produce the runtime Lighthouse CI config that injects it. + * + * Why this exists: a deployed PR preview runs IS_PREVIEW=true and is gated by + * preview-auth.middleware — an UNAUTHENTICATED request 302s to /login, so a + * naive Lighthouse run would measure the login page, not the app. We mint the + * same `__Secure-civitai-token` JWE the app signs with (next-auth/jwt encode + + * the preview's shared NEXTAUTH_SECRET), as ci-smoke-gold (a paid member in the + * flipt `preview-site-access` testers allowlist — id mirrors preview-fixtures / + * the datapacket-talos seed-smoke-test-users CronJob), and put it in + * collect.settings.extraHeaders.Cookie so headless Chrome clears the gate. + * + * This is the SAME mechanism tests/preview-auth.setup.ts uses for the smoke + * suite; kept as a standalone .cjs so the Tekton lighthouse task can run it + * with plain `node` (no ts/playwright) using the next-auth/jwt + uuid already + * installed into the shared workspace node_modules by the typecheck task. + * + * Usage: + * NEXTAUTH_SECRET=... BASE_URL=https://pr-123.civitaic.com \ + * node tests/lighthouse-mint-cookie.cjs + * Writes lighthouserc.runtime.json (cwd) with extraHeaders + per-PR URLs. + * Prints nothing sensitive (never the cookie value) to stdout. + */ +const fs = require('fs'); +const path = require('path'); +const { encode } = require('next-auth/jwt'); +const { v4: uuid } = require('uuid'); + +const SECRET = process.env.NEXTAUTH_SECRET; +const BASE_URL = process.env.BASE_URL; +const COOKIE_NAME = '__Secure-civitai-token'; // libs/auth.ts — https => __Secure- prefix +const MAX_AGE_S = 30 * 24 * 60 * 60; + +// Representative authed routes. Kept small (3) so 5 runs x 3 routes stays inside +// the build pool's time budget. All are reachable by ci-smoke-gold and are +// present regardless of the preview's DB content (they don't depend on a +// specific seeded entity). `/` = SSR home, `/models` = heavy list/feed, +// `/generate` = client-heavy generator. Edit here to change what's measured. +const ROUTES = ['/', '/models', '/generate']; + +// ci-smoke-gold — must mirror tests/preview-fixtures.ts PREVIEW_USERS.gold. +const GOLD = { + id: 2000000004, + username: 'ci-smoke-gold', + email: 'ci-smoke-gold@civitai.test', + isModerator: false, + tier: 'gold', + showNsfw: true, + blurNsfw: false, + browsingLevel: 1, + onboarding: 15, + muted: false, +}; + +async function main() { + if (!SECRET) throw new Error('NEXTAUTH_SECRET is required to mint the preview cookie'); + if (!BASE_URL) throw new Error('BASE_URL is required (e.g. https://pr-123.civitaic.com)'); + + const token = { user: GOLD, sub: String(GOLD.id), id: uuid(), signedAt: Date.now() }; + const value = await encode({ token, secret: SECRET, maxAge: MAX_AGE_S }); + + const base = JSON.parse( + fs.readFileSync(path.join(process.cwd(), 'lighthouserc.json'), 'utf8') + ); + + base.ci.collect.url = ROUTES.map((r) => `${BASE_URL.replace(/\/$/, '')}${r}`); + base.ci.collect.settings = base.ci.collect.settings || {}; + // extraHeaders must be a JSON STRING per the LHCI schema. + base.ci.collect.settings.extraHeaders = JSON.stringify({ + Cookie: `${COOKIE_NAME}=${value}`, + }); + + fs.writeFileSync('lighthouserc.runtime.json', JSON.stringify(base, null, 2)); + console.log( + `Wrote lighthouserc.runtime.json — ${ROUTES.length} routes x ${base.ci.collect.numberOfRuns} runs, authed as ${GOLD.username}` + ); + for (const u of base.ci.collect.url) console.log(` - ${u}`); +} + +main().catch((e) => { + console.error(`mint-cookie failed: ${e.message}`); + process.exit(1); +});