Location:.gitea/workflows/ci.yml (no browser step), src/**/*.test.ts (104 files, all pure logic; zero .test.tsx, no jsdom, no Playwright)
Problem
Nothing in CI renders a component or loads the app in a browser. The two critical E2EE findings (#6 compress-image uploads plaintext, #7 scheduled messages bypass encryption) live in RoomInput.tsx, which has no test coverage of any kind, and both would have been caught by a single end-to-end assertion that an attachment sent in an encrypted room carries a file block rather than a url.
Suggested fix
Add a Playwright job (the runner already has Chromium via ~/.cache/ms-playwright) that: serves dist/ with vite preview, logs in with a throwaway account on a test homeserver (or a local Synapse container), opens an encrypted DM with itself, sends a text message, an image with "compress" ticked, and a GIF, and asserts the resulting events are m.room.encrypted with file blocks. Gate it on pull requests first; promote to a push gate once it is stable. Keep it to 3–5 scenarios so it stays under two minutes.
Filed from the September 2026 client audit (CI pipeline review, branch lotus @ 4bea4895).
**Location:** `.gitea/workflows/ci.yml` (no browser step), `src/**/*.test.ts` (104 files, all pure logic; zero `.test.tsx`, no jsdom, no Playwright)
### Problem
Nothing in CI renders a component or loads the app in a browser. The two critical E2EE findings (#6 compress-image uploads plaintext, #7 scheduled messages bypass encryption) live in `RoomInput.tsx`, which has no test coverage of any kind, and both would have been caught by a single end-to-end assertion that an attachment sent in an encrypted room carries a `file` block rather than a `url`.
### Suggested fix
Add a Playwright job (the runner already has Chromium via `~/.cache/ms-playwright`) that: serves `dist/` with `vite preview`, logs in with a throwaway account on a test homeserver (or a local Synapse container), opens an encrypted DM with itself, sends a text message, an image with "compress" ticked, and a GIF, and asserts the resulting events are `m.room.encrypted` with `file` blocks. Gate it on pull requests first; promote to a push gate once it is stable. Keep it to 3–5 scenarios so it stays under two minutes.
---
_Filed from the September 2026 client audit (CI pipeline review, branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · High milestone 2026-09-12 01:57:42 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Location:
.gitea/workflows/ci.yml(no browser step),src/**/*.test.ts(104 files, all pure logic; zero.test.tsx, no jsdom, no Playwright)Problem
Nothing in CI renders a component or loads the app in a browser. The two critical E2EE findings (#6 compress-image uploads plaintext, #7 scheduled messages bypass encryption) live in
RoomInput.tsx, which has no test coverage of any kind, and both would have been caught by a single end-to-end assertion that an attachment sent in an encrypted room carries afileblock rather than aurl.Suggested fix
Add a Playwright job (the runner already has Chromium via
~/.cache/ms-playwright) that: servesdist/withvite preview, logs in with a throwaway account on a test homeserver (or a local Synapse container), opens an encrypted DM with itself, sends a text message, an image with "compress" ticked, and a GIF, and asserts the resulting events arem.room.encryptedwithfileblocks. Gate it on pull requests first; promote to a push gate once it is stable. Keep it to 3–5 scenarios so it stays under two minutes.Filed from the September 2026 client audit (CI pipeline review, branch
lotus@4bea4895).