ci: run every test file, and enforce that committed bundles are current - #23
Merged
Conversation
…dles Clears the one open Dependabot alert (GHSA-67mh-4wv8-2f99, esbuild's dev server accepting cross-origin requests). The advisory does not actually apply to this repo — scripts/build.js only ever calls esbuild.buildSync, never `serve` — but the fix is cheap and the alert was the last one outstanding here. esbuild is a direct devDependency, so this crosses six 0.x minors. The API surface in use is just buildSync with bundle/platform/target/ outfile/banner options, all unchanged across that range. scripts/dist/*.cjs are committed build artifacts consumed by the composite actions, so they are rebuilt here. The discover bundle shrinks by ~400 lines net, which is 0.25's tighter codegen rather than dropped functionality. Verified: - npm audit: 0 vulnerabilities - npm test: 32/32 pass - both bundles pass `node --check` and are require()-able - mode stays 100755, which .github/workflows/test.yml asserts - ran the three bundle entrypoints test.yml exercises against test-fixtures/valid: discover-all, validate, generate — all exit 0 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018DDkZGNoSVspVq1Z9jcVtP
…urrent
Three gaps, all of the same shape — checks that existed but were never
enforced, so they read as green while covering nothing.
1. `npm test` named one file explicitly:
"test": "node scripts/test/discover-components.test.js"
scripts/test/opencode-release.test.js was therefore never executed,
despite containing six passing tests. It covers opencode-release.js,
which is bundled into scripts/dist/opencode-release.cjs and run by
the agentic-marketplace publish action. Replaced with
scripts/run-tests.js, which discovers scripts/test/*.test.js so
adding a file is enough to get it run. Both harnesses here (the
hand-rolled printer and node:test) exit non-zero on failure, so exit
status is the only contract needed. 38 tests now run, up from 32.
2. No workflow ran `npm test` at all, so the whole unit suite was
local-only. Adds a unit-tests job that does `npm ci && npm test`.
3. Nothing checked that scripts/dist matches scripts/src, so a source
fix could merge and never reach the action that runs it. The
unit-tests job now rebuilds and fails on any diff. `npm run build`
is idempotent, so this is stable.
Also extends the bundle checks from discover-components.cjs alone to
both bundles, and adds `node --check` to each — opencode-release.cjs
had no existence, permission, or parse check at all.
Verified locally:
- npm test runs both files, 38 pass
- a deliberately failing extra test file makes the runner exit 1,
and removing it returns to 0
- the drift check exits 1 when scripts/src is edited without a
rebuild, and 0 once back in sync
- both bundles pass the exists/executable/node --check loop
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DDkZGNoSVspVq1Z9jcVtP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three gaps, all the same shape: checks that existed but were never enforced, so they read green while covering nothing.
1. A whole test file was never executed
npm testnamed one file explicitly:scripts/test/opencode-release.test.jswas therefore never run — bynpm testor by any workflow — despite containing six passing tests. It coversopencode-release.js, which is bundled intoscripts/dist/opencode-release.cjsand run by the agentic-marketplace publish action.Replaced with
scripts/run-tests.js, which discoversscripts/test/*.test.js, so adding a file is enough to get it run. Both harnesses in use (the hand-rolled printer andnode:test) exit non-zero on failure, so exit status is the only contract needed. 38 tests now run, up from 32.2.
npm testran in no workflow at allThe unit suite was local-only. Adds a
unit-testsjob doingnpm ci && npm test.3. Nothing checked
scripts/distagainstscripts/srcscripts/dist/*.cjsare committed artifacts consumed by the composite actions — a source fix could merge and never reach the action that runs it. The job now rebuilds and fails on any diff (npm run buildis idempotent, so this is stable).Also extends the bundle checks from
discover-components.cjsalone to both bundles, addingnode --checkto each.opencode-release.cjspreviously had no existence, permission, or parse check.Verified locally
npm testruns both files → 38 passscripts/srcis edited without a rebuild, 0 once back in syncnode --checkloopContext: this is the same class of bug as santaclaw#58 — an env-gated e2e test that skipped into green. Found while re-auditing my own claim of "32/32 tests pass" when merging #22, which turned out to be a local result CI never checked.
🤖 Generated with Claude Code
https://claude.ai/code/session_018DDkZGNoSVspVq1Z9jcVtP