From b2f06030372e096ec830159070b274ca8e93998b Mon Sep 17 00:00:00 2001
From: dormouse-bot <287024035+dormouse-bot@users.noreply.github.com>
Date: Tue, 13 Oct 2026 14:17:20 +0000
Subject: [PATCH] Read the audit window from workflow-audit.yaml in its test
 instead of a stale copy

The test typed out WINDOW with four paths; the shipped step has eight since
.gitattributes and the markdown merge scripts joined the window, so the
classifiers were exercised against a narrower window than CI runs. Extract
both WINDOW lines from the run block, as the classifier already is, and pin
that a regeneration also editing scripts/md-unwrap.mjs is refused.
---
 scripts/workflow-audit.test.mjs | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/scripts/workflow-audit.test.mjs b/scripts/workflow-audit.test.mjs
index d12b313ed..ac965daab 100644
--- a/scripts/workflow-audit.test.mjs
+++ b/scripts/workflow-audit.test.mjs
@@ -10,6 +10,12 @@ import { tempDir, workflowRunBlock } from './lint-kit.mjs';
 const workflow = readFileSync(new URL('../.github/workflows/workflow-audit.yaml', import.meta.url), 'utf8');
 const auditBlock = workflowRunBlock(workflow, 'Audit workflow file changes');
 const classifier = auditBlock.slice(auditBlock.indexOf('is_tend_regen() {'), auditBlock.indexOf('\nREPORT=$(mktemp)'));
+// The shipped window, not a copy: a typed-out list drifts as paths are added.
+const windowLines = ['WINDOW', 'WINDOW_NON_WORKFLOW'].map(name => {
+  const line = auditBlock.match(new RegExp(`^${name}=.*$`, 'm'))?.[0];
+  assert.ok(line, `missing ${name}= in the audit step`);
+  return line;
+}).join('\n');
 const original = '# Generated by tend 0.1.24. Regenerate with: uvx tend@latest init\noriginal\n';
 const generated = original.replace('original', 'generated');
 
@@ -63,8 +69,7 @@ login="\${BASH_REMATCH[1]}"
 if [[ " \${ADMINS:-} " = *" $login "* ]]; then echo admin; else echo write; fi
 `, { mode: 0o755 });
   const classify = (sha, extraEnv = {}, fn = 'is_tend_regen') => spawnSync('bash', ['-c', `set -euo pipefail
-WINDOW=(.github/workflows/ .config/tend.yaml .github/audit/ .vscode/)
-WINDOW_NON_WORKFLOW=("\${WINDOW[@]:1}")
+${windowLines}
 ${classifier}
 prepare_activity
 ${fn} "$1"
@@ -115,6 +120,13 @@ test('reports a config change even when its workflows reproduce', t => {
   assert.equal(f.classify(f.commit()).status, 1);
 });
 
+test('refuses a regeneration that also edits a non-workflow window path', t => {
+  const f = fixture(t);
+  f.write('scripts/md-unwrap.mjs', 'changed\n');
+  f.write('.github/workflows/tend-review.yaml', generated);
+  assert.equal(f.classify(f.commit()).status, 1);
+});
+
 const ZERO = '0'.repeat(40);
 
 function mergeFixture(t) {