release: v1.8.0 — R2 watchlist cache + E2E coverage - #45
Conversation
- Add Playwright API, UI, and live smoke coverage - Configure disposable Supabase CI jobs and local test setup - Update shared Stremio types, tooling, and database schema
- Add local S3-compatible storage setup and cleanup helpers - Validate cache persistence, pagination, and watchlist removal
feat(e2e): add Stremio end-to-end CI harness
…wngrade Move watchlist caching to R2 and add Stremio E2E coverage
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Greptile SummaryThe release moves watchlist caching from Supabase to generation-based R2 objects, removes the legacy cache tables, and adds catalog pagination plus an end-to-end test environment.
Confidence Score: 2/5The PR is not yet safe to merge because the mutable CI action remains executable and retained watchlists can still serve cache data from their previous IMDb source. The E2E workflow still executes a mutable third-party action tag, and changing a retained watchlist's IMDb source still leaves its UUID-keyed R2 cache intact for cache-first catalog and metadata reads. Files Needing Attention: .github/workflows/ci.yml and apps/backend/src/services/user.ts
|
| Filename | Overview |
|---|---|
| apps/backend/src/services/watchlist-cache.ts | Implements compressed, generation-based R2 cache storage with manifest validation, conditional deletion, stale-manifest recovery, and bounded memory caching. |
| apps/backend/src/services/watchlist.ts | Replaces database-backed cache access with R2 reads and writes while retaining cache-first, refresh, fallback, sorting, and RPDB behavior. |
| apps/backend/src/services/user.ts | Cleans R2 objects for removed watchlists, but the previously reported retained-watchlist source invalidation defect remains. |
| apps/backend/src/routes/catalog.ts | Adds validated skip-based pagination, stable page sizing, and no-store response caching. |
| .github/workflows/ci.yml | Adds bundle smoke testing and full E2E infrastructure, while the previously reported mutable third-party action reference remains. |
| supabase/migrations/20260826000000_drop_cache_tables_after_r2.sql | Removes the legacy Supabase cache tables after the documented R2 rollout boundary. |
| apps/e2e/playwright.config.ts | Configures the Playwright harness and dependent local services for addon, configuration, catalog, and metadata coverage. |
Reviews (2): Last reviewed commit: "fix(backend): externalize S3 client from..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| node-version: 20 | ||
| cache: pnpm | ||
|
|
||
| - uses: supabase/setup-cli@v1 |
There was a problem hiding this comment.
The E2E job replaces the previously pinned Supabase setup action with the mutable v1 tag, allowing an upstream tag change to silently execute different code with access to the checked-out repository and the job's read-only token. Pinning the action to its immutable commit keeps workflow changes reviewable.
How this was verified: The pull-request E2E job directly executes supabase/setup-cli@v1 without exposing the separate push-only release credential.
| - uses: supabase/setup-cli@v1 | |
| - uses: supabase/setup-cli@ab058987d8d6c725971f6cf9d0b5c98467e30bd1 # v1 |
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
There was a problem hiding this comment.
We removed SHA pinning from the CI as it's overkill for what it is
There was a problem hiding this comment.
That’s a reasonable tradeoff if SHA pinning isn’t part of this repository’s CI threat model. The concern is specifically that @v1 can change upstream without a reviewed PR, while the action runs with repository access; however, since this is intentional and the job only has the default read-only token, I won’t pursue it further for this release.
|
CI was dispatched manually because GitHub did not emit an automatic pull_request or staging push workflow run for this PR. Both jobs passed on the current release head before the final trigger-only workflow change: Lint, Build & Test + E2E. The latest Vercel backend preview is healthy. |
1 participant
Release v1.8.0
Promotes staging to main.
Changes
Release notes