Playwright automation: Employer Login and Job Post fixes#1
Merged
Conversation
…ve missing global applicants option
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughRemoves a deprecated “allow global applicants” click from the employer page object, adds a Playwright employer login test suite, updates a job-post test email, and adds a GitHub Actions workflow to run Playwright E2E tests and upload the report. ChangesEmployer Authentication and CI
Sequence Diagram(s)sequenceDiagram
participant Developer
participant GitHubActions
participant Runner
participant Playwright
participant ArtifactStore
Developer->>GitHubActions: push/PR/dispatch triggers workflow
GitHubActions->>Runner: start ubuntu-latest job
Runner->>Playwright: install browsers & deps
Runner->>Playwright: run `npx playwright test`
Playwright->>ArtifactStore: upload `playwright-report/`
🎯 3 (Moderate) | ⏱️ ~20 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/employerLogin.spec.ts`:
- Around line 4-5: Tests hardcode credentials causing security risk; replace the
inline constants EMAIL and PASS in tests/employerLogin.spec.ts (lines 4-5) with
environment-backed values (e.g., read process.env.EMPLOYER_TEST_EMAIL and
process.env.EMPLOYER_TEST_PASS) and add a fail-fast guard that throws or calls
fail if either env var is missing, and in tests/employerJobPost.spec.ts (lines
16-17) remove the local literal credentials and consume the same shared
env-backed credential source used by employerLogin.spec.ts (no change needed to
test logic beyond using the env variables or a shared helper), ensuring both
files reference the same env names so credential rotation is centralized.
- Around line 53-55: Replace the hard-coded email literal used for TC5 with a
deterministic, per-run unique non-existent address: generate a testEmail (for
example using Date.now() or a UUID) and use emailInput.fill(testEmail) instead
of the static 'user@company.com'; ensure the domain is a safe non-deliverable
host like example.com or a plus-addressing pattern (e.g.,
`nonexistent+${Date.now()}`@example.com``) so the address cannot collide with real
accounts.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 036dab7d-8502-418c-8562-e03daf6677b1
📒 Files selected for processing (3)
pages/AvuaEmployerPage.tstests/employerJobPost.spec.tstests/employerLogin.spec.ts
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/playwright.yml (1)
15-15: ⚡ Quick winUse a fixed Node major version instead of
lts/*for deterministic CI.Line 15 uses
node-version: lts/*, which can silently change and destabilize test runs. Pin to an explicit major (for example22) and upgrade intentionally.Suggested reliability diff
- node-version: lts/* + node-version: '22'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/playwright.yml at line 15, The workflow currently pins Node with node-version: lts/* which can change unpredictably; replace the lts/* value with a fixed major (e.g., node-version: "22") under the node-version key in the Playwright workflow to ensure deterministic CI runs and update it intentionally when upgrading Node.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/playwright.yml:
- Around line 12-13: Replace the floating action tags with fixed commit SHAs:
update the three `uses:` entries `actions/checkout@v4`, `actions/setup-node@v4`,
and `actions/upload-artifact@v4` to the corresponding repository commit SHAs
(e.g., `actions/checkout@<full-sha>`, `actions/setup-node@<full-sha>`,
`actions/upload-artifact@<full-sha>`); obtain the correct SHA for each action
from its GitHub repo (releases/tags or the default branch commit that matches
the v4 tag) and substitute the tag with that full 40-character commit SHA so the
workflow is pinned to immutable versions.
- Around line 12-15: Update the actions/checkout@v4 step to disable credential
persistence by adding persist-credentials: false under its with: block;
specifically modify the checkout step (uses: actions/checkout@v4) to include a
with: section containing persist-credentials: false so the job does not
automatically inject auth tokens into the workspace.
---
Nitpick comments:
In @.github/workflows/playwright.yml:
- Line 15: The workflow currently pins Node with node-version: lts/* which can
change unpredictably; replace the lts/* value with a fixed major (e.g.,
node-version: "22") under the node-version key in the Playwright workflow to
ensure deterministic CI runs and update it intentionally when upgrading Node.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 0105cf62-c9ad-4194-960d-53b30287fbe0
📒 Files selected for processing (1)
.github/workflows/playwright.yml
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/playwright.yml:
- Around line 1-2: Add explicit least-privilege GITHUB_TOKEN permissions to the
workflow by adding a top-level permissions block and set contents: read (e.g.,
add "permissions: contents: read" under the workflow name) so the job does not
inherit broader repository defaults; update the existing Playwright workflow
file's top-level to include this permissions stanza and no other code changes
are required.
- Around line 9-14: The workflow defines the frontend_branch input but the
checkout step doesn't use it; update the actions/checkout step (the checkout
step that currently checks out the repo) to set ref: ${{
github.event.inputs.frontend_branch || github.ref }} so the manually-dispatched
frontend_branch input is honored (keep step name unchanged, only add the ref
expression to the existing actions/checkout invocation).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 73d7606f-64b1-48ff-b73d-30a020ea3b3c
📒 Files selected for processing (1)
.github/workflows/playwright.yml
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/playwright.yml (1)
20-20:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDisable checkout credential persistence on Line 20.
actions/checkoutstill uses default credential persistence; addpersist-credentials: falseto reduce token exposure risk in job context/artifacts.What is the default value of `persist-credentials` for `actions/checkout` v4/v5, and what is the recommended hardening setting for least-privilege CI workflows?🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/playwright.yml at line 20, The checkout step currently leaves credential persistence enabled (default persist-credentials: true for actions/checkout v4/v5); update the checkout invocation that uses actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 to add a with: block setting persist-credentials: false to harden the job (ensure proper YAML indentation), i.e. add the persist-credentials: false option to the actions/checkout step to enforce least-privilege CI workflows.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/playwright.yml:
- Line 20: The checkout step currently leaves credential persistence enabled
(default persist-credentials: true for actions/checkout v4/v5); update the
checkout invocation that uses
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 to add a with: block
setting persist-credentials: false to harden the job (ensure proper YAML
indentation), i.e. add the persist-credentials: false option to the
actions/checkout step to enforce least-privilege CI workflows.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 4629e215-dcb3-4735-b1fb-4f6b2852b7c8
📒 Files selected for processing (1)
.github/workflows/playwright.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes:
Summary by CodeRabbit
Bug Fixes
Tests
Chores