@1aboveio/skills 0.0.0-stage → 1.0.0

package/skills/cicd/github-actions/scripts/ci-run-audit.test.mjs

@@ -0,0 +1,637 @@
+// Tests exercise pure decisions, the gh provider boundary and the real saved-data CLI.
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+import { analyze, render, lane, DEFAULT_IGNORE, fetchRuns, fetchRun, profileRun, renderProfile } from './ci-run-audit-core.mjs'
+
+const T0 = Date.parse('2026-09-01T00:00:00Z')
+const at = (m) => new Date(T0 + m * 60000).toISOString()
+
+// A job that starts at `start` minutes and runs `mins`, with optional setup minutes.
+function job(name, conclusion, start, mins, setup = 0) {
+  const steps = []
+  if (setup) steps.push({ name: 'Set up job', conclusion: 'success', started: at(start), completed: at(start + setup) })
+  steps.push({ name: `Run ${name}`, conclusion, started: at(start + setup), completed: at(start + mins) })
+  return { name, conclusion, created: at(start), started: at(start), completed: at(start + mins), steps }
+}
+let id = 0
+const runOf = (o) => ({ id: ++id, workflow: 'CI', event: 'pull_request', branch: 'feat/x', defaultBranch: 'main', created: at(o.start ?? 0), ...o })
+
+test('lane: queue branches, PRs, default-branch pushes, and everything else', () => {
+  assert.equal(lane({ branch: 'mergify/merge-queue/abc', event: 'pull_request' }), 'queue')
+  assert.equal(lane({ branch: 'gh-readonly-queue/main/pr-1', event: 'merge_group' }), 'queue')
+  assert.equal(lane({ branch: 'feat/x', event: 'pull_request' }), 'pr')
+  assert.equal(lane({ branch: 'trunk', defaultBranch: 'trunk', event: 'push' }), 'main')
+  assert.equal(lane({ branch: 'main', event: 'schedule' }), 'schedule')
+})
+
+test('re-proved: a job passing again on the same tree counts, by lane pair; a new tree does not', () => {
+  const a = analyze([
+    runOf({ sha: 's1', tree: 't1', start: 0, jobs: [job('test', 'success', 0, 4)] }),
+    runOf({ sha: 'q1', tree: 't1', branch: 'mergify/merge-queue/1', start: 10, jobs: [job('test', 'success', 10, 4)] }),
+    runOf({ sha: 'm1', tree: 't1', event: 'push', branch: 'main', start: 20, jobs: [job('test', 'success', 20, 4)] }),
+    runOf({ sha: 's2', tree: 't2', start: 30, jobs: [job('test', 'success', 30, 4)] }),
+  ])
+  assert.equal(a.reproved.passMin, 16)
+  assert.equal(a.reproved.reprovedMin, 8)
+  assert.deepEqual(a.reproved.byLanePair, { 'pr→queue': 4, 'pr→main': 4 })
+  assert.equal(a.reproved.byJob.test, 8)
+})
+
+test('re-proved: scheduled repeats are deliberate, reported apart and not counted as waste', () => {
+  const a = analyze([
+    runOf({ sha: 'm1', tree: 't1', event: 'schedule', branch: 'main', start: 0, jobs: [job('nightly', 'success', 0, 10)] }),
+    runOf({ sha: 'm1', tree: 't1', event: 'schedule', branch: 'main', start: 1440, jobs: [job('nightly', 'success', 1440, 10)] }),
+  ])
+  assert.equal(a.reproved.reprovedMin, 0)
+  assert.equal(a.reproved.scheduledRepeatMin, 10)
+})
+
+test('re-proved: a failed first attempt does not make the later pass a repeat', () => {
+  const a = analyze([
+    runOf({ sha: 's1', tree: 't1', start: 0, jobs: [job('test', 'failure', 0, 4)] }),
+    runOf({ sha: 's1', tree: 't1', start: 10, jobs: [job('test', 'success', 10, 4)] }),
+  ])
+  assert.equal(a.reproved.reprovedMin, 0)
+})
+
+test('yield: sole catches, shared failures, and fail-then-pass flakes are told apart', () => {
+  const a = analyze([
+    // t1: unit alone fails -> a sole catch for unit
+    runOf({ sha: 's1', tree: 't1', jobs: [job('unit', 'failure', 0, 2), job('lint', 'success', 0, 1)] }),
+    // t2: unit and lint both fail -> shared, no sole catch
+    runOf({ sha: 's2', tree: 't2', jobs: [job('unit', 'failure', 0, 2), job('lint', 'failure', 0, 1)] }),
+    // t3: lint fails then passes on the same tree -> flaky, not a real failure
+    runOf({ sha: 's3', tree: 't3', jobs: [job('unit', 'success', 0, 2), job('lint', 'failure', 0, 1)] }),
+    runOf({ sha: 's3', tree: 't3', start: 5, jobs: [job('lint', 'success', 5, 1)] }),
+  ], { minTrees: 3 })
+  const row = (n) => a.yield.find((e) => e.job === n)
+  assert.deepEqual([row('unit').trees, row('unit').failed, row('unit').sole, row('unit').flaky], [3, 2, 1, 0])
+  assert.deepEqual([row('lint').trees, row('lint').failed, row('lint').sole, row('lint').flaky], [3, 1, 0, 1])
+  assert.deepEqual(a.noSoleCatch.map((e) => e.job), ['lint'])
+})
+
+test('yield: umbrella jobs are ignored, so they never make a real failure look shared', () => {
+  const a = analyze([
+    runOf({ sha: 's1', tree: 't1', jobs: [job('unit', 'failure', 0, 2), job('all-gates', 'failure', 2, 0.1)] }),
+  ], { minTrees: 1 })
+  assert.equal(a.yield.find((e) => e.job === 'unit').sole, 1)
+  assert.equal(a.yield.find((e) => e.job === 'all-gates'), undefined)
+})
+
+test('DEFAULT_IGNORE drops roll-ups but keeps real checks that happen to say "gate"', () => {
+  for (const n of ['all-gates', 'CI', 'PR admission gate', 'Merge queue gate', 'Post-deploy validation verdict', 'CI timing report']) assert.ok(DEFAULT_IGNORE.test(n), n)
+  for (const n of ['smoke-gate', 'route-docs-gate', 'PR Gate (install + builds + syntax)', 'Smoke Gate (golden paths)', 'typecheck']) assert.ok(!DEFAULT_IGNORE.test(n), n)
+})
+
+test('overlap: a job whose every failure (>=3) coincided with another job failing', () => {
+  const runs = [1, 2, 3].map((i) => runOf({ sha: `s${i}`, tree: `t${i}`, jobs: [job('sweep', 'failure', 0, 5), job('smoke', 'failure', 0, 5)] }))
+  runs.push(runOf({ sha: 's4', tree: 't4', jobs: [job('sweep', 'success', 0, 5), job('smoke', 'failure', 0, 5)] }))
+  const a = analyze(runs)
+  assert.deepEqual(a.overlap.find((o) => o.job === 'sweep'), { job: 'sweep', alwaysWith: 'smoke', failures: 3, otherFailures: 4 })
+  assert.equal(a.overlap.find((o) => o.job === 'smoke'), undefined, 'smoke failed once without sweep')
+})
+
+test('setup share: flags jobs that are mostly setup, not ones that are mostly work', () => {
+  const runs = [1, 2, 3].map((i) => runOf({ sha: `s${i}`, tree: `t${i}`, jobs: [job('ledger', 'success', 0, 1, 0.95), job('e2e', 'success', 0, 10, 2)] }))
+  const a = analyze(runs)
+  assert.deepEqual(a.setup.map((e) => e.job), ['ledger'])
+  assert.ok(Math.abs(a.setup[0].setupShare - 0.95) < 1e-9)
+})
+
+test('history keeps same-named workflows and checks separate in yield and overlap', () => {
+  const runs = [1, 2, 3].flatMap((i) => [
+    runOf({ workflowId: 1, tree: `t${i}`, jobs: [job('unit', 'failure', 0, 2), job('lint', 'failure', 0, 1)] }),
+    runOf({ workflowId: 2, tree: `t${i}`, jobs: [job('unit', 'success', 0, 2), job('lint', 'success', 0, 1)] }),
+  ])
+  const a = analyze(runs, { minTrees: 3 })
+  assert.equal(a.yield.length, 4)
+  const unit = a.yield.find((e) => e.job === 'CI [1] / unit')
+  assert.deepEqual([unit.trees, unit.failed, unit.flaky], [3, 3, 0])
+  assert.deepEqual(unit.coFail, { 'CI [1] / lint': 3 })
+  assert.deepEqual(a.overlap.find((e) => e.job === unit.job), {
+    job: unit.job, alwaysWith: 'CI [1] / lint', failures: 3, otherFailures: 3,
+  })
+  assert.equal(a.yield.find((e) => e.job === 'CI [2] / unit').failed, 0)
+  assert.match(render(a), /CI \[1\] \/ unit/)
+})
+
+test('history keeps setup samples separate by workflow identity', () => {
+  const runs = [1, 2, 3].flatMap((i) => [
+    runOf({ workflowId: 1, tree: `t${i}`, jobs: [job('ledger', 'success', 0, 1, 0.95)] }),
+    runOf({ workflowId: 2, tree: `t${i}`, jobs: [job('ledger', 'success', 0, 10, 2)] }),
+  ])
+  const a = analyze(runs)
+  assert.equal(a.setup.length, 1)
+  assert.equal(a.setup[0].job, 'CI [1] / ledger')
+  assert.equal(a.setup[0].runs, 3)
+  assert.ok(Math.abs(a.setup[0].setupShare - 0.95) < 1e-9)
+})
+
+test('history preserves failure overlap across distinct workflows on the same code states', () => {
+  const runs = [1, 2, 3].flatMap((i) => [
+    runOf({ workflow: 'Unit CI', workflowId: 1, tree: `t${i}`, jobs: [job('unit', 'failure', 0, 2)] }),
+    runOf({ workflow: 'Integration CI', workflowId: 2, tree: `t${i}`, jobs: [job('integration', 'failure', 0, 2)] }),
+  ])
+  const a = analyze(runs, { minTrees: 3 })
+  for (const e of a.yield) {
+    assert.equal(e.failed, 3)
+    assert.equal(e.sole, 0)
+    assert.equal(e.flaky, 0)
+  }
+  assert.deepEqual(a.yield.find((e) => e.job === 'unit').coFail, { integration: 3 })
+  assert.deepEqual(a.overlap.find((e) => e.job === 'unit'), {
+    job: 'unit', alwaysWith: 'integration', failures: 3, otherFailures: 3,
+  })
+})
+
+test('workflow-path fallback disambiguates repeat candidates and last finishers', () => {
+  const a = analyze([
+    runOf({ workflowPath: '.github/workflows/a.yml', sha: 'a', tree: 't', jobs: [job('unit', 'success', 0, 1)] }),
+    runOf({ workflowPath: '.github/workflows/b.yml', sha: 'b', tree: 't', jobs: [job('unit', 'success', 0, 2)] }),
+    runOf({ workflowPath: '.github/workflows/a.yml', sha: 'q', tree: 't', start: 10,
+      branch: 'mergify/merge-queue/1', jobs: [job('unit', 'success', 10, 1)] }),
+  ])
+  assert.equal(a.yield.length, 2)
+  assert.deepEqual(a.reproved.byJob, { 'CI [.github/workflows/a.yml] / unit': 1 })
+  assert.deepEqual(a.criticalPath.lastJob, {
+    'CI [.github/workflows/a.yml] / unit': 1,
+    'CI [.github/workflows/b.yml] / unit': 1,
+  })
+})
+
+test('history and profile both exclude unknown or inconsistent setup measurements', () => {
+  const variants = [
+    { name: 'missing end', steps: [{ name: 'Test', started: at(0), completed: null }] },
+    { name: 'negative step', steps: [{ name: 'Test', started: at(2), completed: at(1) }] },
+    { name: 'out of bounds', steps: [{ name: 'Test', started: at(9), completed: at(11) }] },
+    { name: 'overlap', steps: [{ name: 'Install deps', started: at(0), completed: at(4) }, { name: 'Test', started: at(3), completed: at(5) }] },
+    { name: 'no steps', steps: [] },
+    { name: 'untimed job', completed: null, steps: [{ name: 'Test', started: at(0), completed: at(5) }] },
+  ]
+  const runs = [1, 2, 3].map((i) => runOf({ tree: `t${i}`, jobs: [
+    ...variants.map((j) => ({ conclusion: 'success', created: at(0), started: at(0), completed: at(10), ...j })),
+    job('measured', 'success', 0, 1, 0.95),
+  ] }))
+  const a = analyze(runs)
+  assert.deepEqual(a.setup.map((e) => e.job), ['measured'])
+  assert.equal(a.dataGaps.timings.filter((g) => g.reason.startsWith('setup/work')).length, 18)
+  for (const j of profileRun(runs, runs[0].id).jobs.slice(0, variants.length)) {
+    assert.equal(j.workS, null, j.name)
+    assert.equal(j.setupS, null, j.name)
+  }
+  assert.match(render(a), /18 unavailable timing measurement/)
+})
+
+test('history scheduling keeps zero, excludes negative/missing/skipped intervals, and reports no samples as unknown', () => {
+  const r = runOf({ jobs: [
+    job('zero', 'success', 0, 1),
+    { ...job('delay', 'success', 2, 1), created: at(0) },
+    { ...job('negative', 'success', 0, 1), created: at(2) },
+    { ...job('missing', 'success', 0, 1), created: null },
+    { ...job('skipped', 'skipped', 99, 0), created: at(0) },
+  ] })
+  const a = analyze([r])
+  assert.deepEqual(a.queue, { samples: 2, p50: 1, p90: 0 })
+  assert.equal(a.dataGaps.timings.filter((g) => g.reason === 'created-to-start interval unavailable').length, 2)
+  const unknown = analyze([runOf({ jobs: [r.jobs[2]] })])
+  assert.deepEqual(unknown.queue, { samples: 0, p50: null, p90: null })
+  assert.match(render(unknown), /0 measured job\(s\), p50 unknown, p90 unknown/)
+})
+
+test('history does not invent PR waits from missing SHAs or invalid creation intervals', () => {
+  const a = analyze([
+    runOf({ sha: null, start: 0, jobs: [job('test', 'success', 0, 1)] }),
+    runOf({ sha: null, start: 10, jobs: [job('test', 'success', 10, 3)] }),
+    runOf({ sha: 'invalid', start: 20, jobs: [job('test', 'success', 0, 1)] }),
+    runOf({ sha: 'missing', created: null, jobs: [job('test', 'success', 0, 1)] }),
+  ])
+  assert.equal(a.criticalPath.prCommits, 2)
+  assert.equal(a.criticalPath.p50, 2)
+  assert.equal(a.dataGaps.timings.filter((g) => g.reason === 'PR creation-to-completion interval unavailable').length, 2)
+  const unknown = analyze([])
+  assert.deepEqual(unknown.criticalPath, { prCommits: 0, p50: null, p90: null, lastJob: {} })
+  assert.match(render(unknown), /wait p50 \*\*unknown\*\*, p90 \*\*unknown\*\*/)
+})
+
+test('critical path: PR wait runs from the first run created to the last job done; queue runs excluded', () => {
+  const a = analyze([
+    runOf({ sha: 's1', tree: 't1', start: 0, jobs: [job('lint', 'success', 0, 1), job('unit', 'success', 0, 6)] }),
+    runOf({ sha: 's1', tree: 't1', workflow: 'Other', start: 1, jobs: [job('smoke', 'success', 1, 3)] }),
+    runOf({ sha: 'q1', tree: 't1', branch: 'mergify/merge-queue/1', start: 10, jobs: [job('unit', 'success', 10, 30)] }),
+  ])
+  assert.equal(a.criticalPath.prCommits, 1)
+  assert.equal(a.criticalPath.p50, 6)
+  assert.deepEqual(a.criticalPath.lastJob, { unit: 1 })
+})
+
+test('setup share: time between steps counts as overhead, not as work', () => {
+  // A 1-minute job whose only work step lasts 3s; the rest is runner start and gaps.
+  const j = (start) => ({ name: 'ledger', conclusion: 'success', created: at(start), started: at(start), completed: at(start + 1),
+    steps: [{ name: 'Run node coverage-ledger.mjs validate', conclusion: 'success', started: at(start + 0.5), completed: at(start + 0.55) }] })
+  const a = analyze([1, 2, 3].map((i) => runOf({ sha: `s${i}`, tree: `t${i}`, jobs: [j(0)] })))
+  assert.equal(a.setup[0]?.job, 'ledger')
+  assert.ok(a.setup[0].setupShare > 0.94)
+})
+
+test('critical path: a roll-up job finishing last is skipped for the last real job', () => {
+  const a = analyze([
+    runOf({ sha: 's1', tree: 't1', jobs: [job('unit', 'success', 0, 6), job('all-gates', 'success', 6, 0.2)] }),
+  ])
+  assert.deepEqual(a.criticalPath.lastJob, { unit: 1 })
+  assert.equal(a.criticalPath.p50, 6)
+})
+
+test('stuck: a job past 6h is reported and kept out of the time figures', () => {
+  const a = analyze([
+    runOf({ sha: 's1', tree: 't1', jobs: [job('typecheck', 'cancelled', 0, 1440), job('unit', 'success', 0, 3)] }),
+  ])
+  assert.equal(a.stuck.length, 1)
+  assert.equal(a.stuck[0].job, 'typecheck')
+  assert.equal(a.criticalPath.p50, 3)
+})
+
+test('render: says the sample is too small instead of silently listing no zero-yield jobs', () => {
+  const md = render(analyze([runOf({ sha: 's1', tree: 't1', jobs: [job('unit', 'success', 0, 3)] })]))
+  assert.match(md, /too few to call any job zero-yield/)
+  const big = render(analyze([runOf({ sha: 's1', tree: 't1', jobs: [job('unit', 'success', 0, 3)] })], { minTrees: 1 }))
+  assert.doesNotMatch(big, /too few/)
+  assert.match(big, /No sole catch.*`unit`/)
+})
+
+test('render: every section is present and the report calls itself report-only', () => {
+  const md = render(analyze([runOf({ sha: 's1', tree: 't1', jobs: [job('unit', 'success', 0, 3)] })]), 'o/r')
+  for (const h of ['# CI run audit — o/r', '## 1. Re-proved trees', '## 2. Catch yield', '## 3. Overlap', '## 4. Setup share', '## 5. Critical path', '## 6. Stuck jobs']) assert.match(md, new RegExp(h.replace(/[.()]/g, '\\$&')))
+  assert.match(md, /Report-only/)
+})
+
+test('unknown trees never prove repeats, SHA fallbacks are separate from verified trees and missing SHAs do not collapse', () => {
+  const runs = [
+    runOf({ sha: 'same', tree: null, jobs: [job('unit', 'failure', 0, 2)] }),
+    runOf({ sha: 'same', tree: null, start: 5, jobs: [job('unit', 'success', 5, 2)] }),
+    runOf({ sha: 'different', tree: 'same', start: 10, jobs: [job('unit', 'failure', 10, 2)] }),
+    runOf({ sha: null, tree: null, start: 15, jobs: [job('unit', 'failure', 15, 2)] }),
+    runOf({ sha: null, tree: null, start: 20, jobs: [job('unit', 'success', 20, 2)] }),
+  ]
+  const a = analyze(runs)
+  assert.equal(a.reproved.reprovedMin, 0)
+  assert.deepEqual([a.yield[0].trees, a.yield[0].failed, a.yield[0].flaky], [4, 2, 1])
+  assert.deepEqual(a.dataGaps.unknownTrees.map((r) => r.runId), [runs[0].id, runs[1].id, runs[3].id, runs[4].id])
+  assert.match(render(a), /no verified tree; excluded from identical-tree repeat evidence/)
+})
+
+test('metadata repeat identity uses workflow ID instead of a nonunique display name', () => {
+  const a = analyze([
+    runOf({ workflowId: 1, sha: 'a', tree: 't', jobs: [job('unit', 'success', 0, 2)] }),
+    runOf({ workflowId: 2, sha: 'b', tree: 't', start: 5, jobs: [job('unit', 'success', 5, 2)] }),
+    runOf({ workflowId: 1, sha: 'c', tree: 't', start: 10, jobs: [job('unit', 'success', 10, 2)] }),
+  ])
+  assert.equal(a.reproved.reprovedMin, 2)
+})
+
+test('same PR head across different bases is a metadata candidate with an explicit tested-checkout gap', () => {
+  const runs = [
+    runOf({ id: 61, sha: 'same-head', tree: 'head-tree', baseSha: 'base-a', jobs: [job('unit', 'success', 0, 2)] }),
+    runOf({ id: 62, sha: 'same-head', tree: 'head-tree', baseSha: 'base-b', start: 5, jobs: [job('unit', 'success', 5, 2)] }),
+  ]
+  const a = analyze(runs)
+  assert.equal(a.reproved.reprovedMin, 2)
+  assert.equal(a.reproved.identity, 'run-metadata-tree-candidates')
+  assert.equal(a.reproved.testedCheckoutVerified, false)
+  assert.deepEqual(a.dataGaps.testedCheckouts.map((r) => r.runId), [61, 62])
+  assert.match(render(a), /not verified repeated tested checkouts/)
+  assert.match(render(a), /PR synthetic merges and explicit checkout refs may differ/)
+  assert.match(profileRun(runs, 61).dataGaps.testedCheckouts[0].reason, /not reusable gate proof/)
+})
+
+test('profile separates dispatch and queue intervals, includes overhead gaps, sorts steps and retains job identity', () => {
+  const r = runOf({ id: 51, attempt: 2, url: 'https://github.com/o/r/actions/runs/51',
+    workflowId: 8, workflowPath: '.github/workflows/ci.yml', conclusion: 'failure', sha: 'abc', tree: 't', jobs: [{
+      id: 501, name: 'matrix (linux)', attempt: 2, url: 'https://github.com/o/r/actions/runs/51/job/501',
+      runnerName: 'slot-3', runnerLabels: ['self-hosted', 'linux'], conclusion: 'failure',
+      created: at(3), started: at(5), completed: at(15), steps: [
+        { name: 'Set up job', started: at(5), completed: at(6), conclusion: 'success', number: 1 },
+        { name: 'Unit tests', started: at(7), completed: at(11), conclusion: 'success', number: 2 },
+        { name: 'Install dependencies', started: at(11), completed: at(13), conclusion: 'success', number: 3 },
+        { name: 'Smoke', started: at(13), completed: at(14), conclusion: 'failure', number: 4 },
+        { name: 'Publish', conclusion: 'skipped', number: 5 },
+      ],
+    }] })
+  const p = profileRun([r], '51'), j = p.jobs[0]
+  assert.deepEqual([j.dispatchDelayS, j.queueS, j.elapsedS, j.setupS, j.workS], [180, 120, 600, 300, 300])
+  assert.deepEqual(j.steps.map((s) => [s.name, s.durationS]), [['Unit tests', 240], ['Install dependencies', 120], ['Set up job', 60], ['Smoke', 60], ['Publish', 0]])
+  assert.deepEqual([p.runId, p.attempt, p.workflowId, j.id, j.attempt, j.conclusion, j.runUrl], [51, 2, 8, 501, 2, 'failure', r.url])
+  assert.deepEqual([j.runnerName, j.runnerLabels], ['slot-3', ['self-hosted', 'linux']])
+  assert.deepEqual(j.timingGaps, [])
+  assert.match(renderProfile(p), /not proven runner queue time/)
+  assert.match(renderProfile(p), /Heuristic: job elapsed/)
+})
+
+test('profile nulls unavailable timing instead of inventing zero work or runner attribution', () => {
+  const r = runOf({ id: 52, sha: 's', tree: null, jobs: [
+    { name: 'pending', conclusion: null, created: at(2), steps: [{ name: 'Tests', started: at(3) }] },
+    { name: 'no steps', started: at(5), completed: at(6), steps: [] },
+    { name: 'bad ordering', created: at(5), started: at(4), completed: at(3), steps: [{ name: 'Tests', started: at(4), completed: at(3) }] },
+    { name: 'outside job window', started: at(5), completed: at(6), steps: [
+      { name: 'Tests', started: at(1), completed: at(2) },
+    ] },
+    { name: 'overlapping work', started: at(0), completed: at(1), steps: [
+      { name: 'Tests A', started: at(0), completed: at(1) }, { name: 'Tests B', started: at(0), completed: at(1) },
+    ] },
+    { name: 'overlapping setup and work', started: at(0), completed: at(10), steps: [
+      { name: 'Install dependencies', started: at(0), completed: at(8) },
+      { name: 'Tests', started: at(5), completed: at(10) },
+    ] },
+  ] })
+  const p = profileRun([r], 52)
+  for (const j of p.jobs) {
+    assert.equal(j.workS, null, j.name)
+    assert.equal(j.setupS, null, j.name)
+    assert.equal(j.runnerLabels, null, j.name)
+    assert.ok(j.timingGaps.length > 0, j.name)
+  }
+  assert.equal(p.jobs[0].elapsedS, null)
+  assert.equal(p.jobs[1].elapsedS, 60)
+  assert.equal(p.jobs[2].queueS, null)
+  assert.equal(p.jobs[2].steps[0].durationS, null)
+  assert.throws(() => profileRun([r], 99), /run 99 not found/)
+  assert.throws(() => profileRun([r, r], 52), /multiple records for run 52/)
+})
+
+// Only the external GitHub REST boundary is substituted. All collection and analysis run.
+function provider(routes) {
+  const calls = []
+  return {
+    calls,
+    api: async (endpoint) => {
+      calls.push(endpoint)
+      assert.ok(routes.has(endpoint), `unexpected GitHub request: ${endpoint}`)
+      const response = routes.get(endpoint)
+      if (response instanceof Error) throw response
+      return structuredClone(response)
+    },
+  }
+}
+const rawRun = (id, extra = {}) => ({
+  id, run_attempt: 1, name: 'CI', workflow_id: 8, path: '.github/workflows/ci.yml',
+  html_url: `https://github.com/o/r/actions/runs/${id}`, head_sha: 'a'.repeat(40),
+  head_branch: 'feat/x', event: 'pull_request', status: 'completed', conclusion: 'success',
+  created_at: at(id * 10), run_started_at: at(id * 10 + 1), ...extra,
+})
+const rawJob = (id, extra = {}) => ({
+  id, run_attempt: 1, name: 'unit', status: 'completed', conclusion: 'success',
+  html_url: `https://github.com/o/r/actions/runs/1/job/${id}`,
+  created_at: at(1), started_at: at(2), completed_at: at(4),
+  runner_id: 3, runner_name: 'slot-3', runner_group_id: 4, runner_group_name: 'linux-pool',
+  labels: ['self-hosted', 'linux', 'x64'], steps: [
+    { number: 1, name: 'Set up job', conclusion: 'success', started_at: at(2), completed_at: at(2.5) },
+    { number: 2, name: 'Unit tests', conclusion: 'success', started_at: at(2.5), completed_at: at(4) },
+  ], ...extra,
+})
+const jobsPath = (id, page = 1, attempt = 1) => `repos/o/r/actions/runs/${id}/attempts/${attempt}/jobs?per_page=100&page=${page}`
+const historyPath = (page = 1) => `repos/o/r/actions/runs?status=completed&per_page=100&page=${page}`
+const commitPath = (sha) => `repos/o/r/commits/${sha}`
+const notFound = () => Object.assign(new Error('commit gone'), { status: 404 })
+
+test('collector resolves and memoizes commit trees, preserves deleted queue unknowns and does not infer equality from SHA', async () => {
+  const deleted = 'b'.repeat(40), verified = 'c'.repeat(40)
+  const raw = [rawRun(1), rawRun(2, { head_branch: 'mergify/merge-queue/1' }),
+    rawRun(3, { head_sha: deleted }), rawRun(4, { head_sha: deleted }),
+    rawRun(5, { head_sha: verified, head_commit: { tree_id: 'other-tree' } })]
+  const routes = new Map([
+    ['repos/o/r', { default_branch: 'main' }], [historyPath(), { workflow_runs: raw }],
+    [commitPath(raw[0].head_sha), { commit: { tree: { sha: 'same-tree' } } }],
+    [commitPath(deleted), notFound()],
+    ...raw.map((r) => [jobsPath(r.id), { total_count: 1, jobs: [rawJob(r.id, {
+      created_at: at(r.id * 10), started_at: at(r.id * 10 + 1), completed_at: at(r.id * 10 + 3),
+    })] }]),
+  ])
+  const gh = provider(routes)
+  const runs = await fetchRuns('o/r', 5, gh.api)
+  const a = analyze(runs)
+  assert.deepEqual(runs.map((r) => r.tree), ['same-tree', 'same-tree', null, null, 'other-tree'])
+  assert.equal(gh.calls.filter((p) => p === commitPath(raw[0].head_sha)).length, 1)
+  assert.equal(gh.calls.filter((p) => p === commitPath(deleted)).length, 1)
+  assert.equal(gh.calls.includes(commitPath(verified)), false)
+  assert.equal(a.reproved.reprovedMin, 2)
+  assert.deepEqual(a.reproved.byLanePair, { 'pr→queue': 2 })
+  assert.deepEqual(a.dataGaps.unknownTrees.map((r) => r.runId), [3, 4])
+  assert.match(a.dataGaps.unknownTrees[0].reason, /HTTP 404.*deleted queue/)
+  assert.equal(runs[0].treeSource, 'commits.commit.tree.sha')
+  const again = await fetchRuns('o/r', 1, gh.api)
+  assert.equal(again[0].tree, 'same-tree')
+  assert.equal(gh.calls.filter((p) => p === commitPath(raw[0].head_sha)).length, 2, 'cache is scoped to one collection')
+})
+
+test('profile collector paginates beyond 100 jobs for the selected attempt and preserves workflow/runner identity', async () => {
+  const r = rawRun(6, { run_attempt: 2, conclusion: 'failure', head_commit: { tree_id: 't' } })
+  const first = Array.from({ length: 100 }, (_, i) => rawJob(i + 1, { name: `matrix ${i}`, run_attempt: 2 }))
+  const last = rawJob(101, { name: 'slow failure', conclusion: 'failure', run_attempt: 2,
+    created_at: at(63), started_at: at(65), completed_at: at(70), steps: [
+      { number: 1, name: 'Install dependencies', started_at: at(65), completed_at: at(67), conclusion: 'success' },
+      { number: 2, name: 'Tests', started_at: at(67), completed_at: at(70), conclusion: 'failure' },
+    ] })
+  const gh = provider(new Map([
+    ['repos/o/r', { default_branch: 'main' }], ['repos/o/r/actions/runs/6', r],
+    [jobsPath(6, 1, 2), { total_count: 101, jobs: first }],
+    [jobsPath(6, 2, 2), { total_count: 101, jobs: [last] }],
+  ]))
+  const runs = await fetchRun('o/r', 6, gh.api), row = runs[0]
+  assert.deepEqual(row.jobs.map((j) => j.id), [...first.map((j) => j.id), 101])
+  assert.equal(analyze(runs).yield.find((j) => j.job === 'slow failure').sole, 1)
+  assert.deepEqual([row.id, row.attempt, row.workflowId, row.workflowPath, row.url], [6, 2, 8, '.github/workflows/ci.yml', r.html_url])
+  assert.deepEqual([row.jobs[100].runnerId, row.jobs[100].runnerName, row.jobs[100].runnerGroupId, row.jobs[100].runnerGroupName], [3, 'slot-3', 4, 'linux-pool'])
+  assert.deepEqual(row.jobs[100].runnerLabels, ['self-hosted', 'linux', 'x64'])
+  const p = profileRun(runs, 6), lastProfile = p.jobs.find((j) => j.name === 'slow failure')
+  assert.deepEqual([lastProfile.attempt, lastProfile.dispatchDelayS, lastProfile.queueS, lastProfile.elapsedS], [2, 180, 120, 300])
+  assert.equal(lastProfile.runUrl, r.html_url)
+  assert.equal(lastProfile.steps[0].number, 2)
+  assert.match(p.dataGaps.collection[0].reason, /only attempt 2 collected/)
+  assert.deepEqual(gh.calls, ['repos/o/r', 'repos/o/r/actions/runs/6', jobsPath(6, 1, 2), jobsPath(6, 2, 2)])
+})
+
+test('history collector paginates runs and the job collector handles absent totals without losing page two', async () => {
+  const raw = Array.from({ length: 101 }, (_, i) => rawRun(i + 1, { head_commit: { tree_id: 't' } }))
+  const routes = new Map([
+    ['repos/o/r', { default_branch: 'main' }],
+    [historyPath(1), { workflow_runs: raw.slice(0, 100) }], [historyPath(2), { workflow_runs: raw.slice(100) }],
+    ...raw.map((r) => [jobsPath(r.id), { jobs: [rawJob(r.id)] }]),
+  ])
+  routes.set(jobsPath(101), { jobs: Array.from({ length: 100 }, (_, i) => rawJob(1000 + i)) })
+  routes.set(jobsPath(101, 2), { jobs: [rawJob(2000, { name: 'page two failure', conclusion: 'failure' })] })
+  const gh = provider(routes), runs = await fetchRuns('o/r', 101, gh.api)
+  assert.deepEqual(runs.map((r) => r.id), raw.map((r) => r.id))
+  assert.equal(runs.at(-1).jobs.at(-1).name, 'page two failure')
+  assert.equal(analyze(runs).yield.find((j) => j.job === 'page two failure').sole, 1)
+  assert.equal(gh.calls.filter((p) => p === jobsPath(101, 2)).length, 1)
+})
+
+test('collector explicitly marks missing commit/attempt metadata and never substitutes head SHA for a tree', async () => {
+  const r = rawRun(7, { run_attempt: undefined })
+  const latest = 'repos/o/r/actions/runs/7/jobs?filter=latest&per_page=100&page=1'
+  const gh = provider(new Map([
+    ['repos/o/r', { default_branch: 'main' }], ['repos/o/r/actions/runs/7', r],
+    [latest, { total_count: 1, jobs: [rawJob(701)] }], [commitPath(r.head_sha), { commit: {} }],
+  ]))
+  const [row] = await fetchRun('o/r', 7, gh.api)
+  assert.equal(row.tree, null)
+  assert.match(row.treeUnknownReason, /no tree SHA/)
+  assert.equal(row.attempt, null)
+  assert.match(row.collectionGaps[0].reason, /attempt unavailable/)
+  assert.equal(profileRun([row], 7).jobs[0].attempt, 1, 'job API attempt remains authoritative when run attempt is missing')
+})
+
+test('collector rejects provider errors, inconsistent pagination and cross-attempt jobs instead of returning partial evidence', async () => {
+  const cases = [
+    ['permission', { jobs: [], total_count: 0 }, Object.assign(new Error('denied'), { status: 403 }), /denied/],
+    ['short page', { jobs: [rawJob(1)], total_count: 2 }, null, /incomplete jobs response/],
+    ['duplicate IDs', { jobs: [rawJob(1), rawJob(1)], total_count: 2 }, null, /duplicate job/],
+    ['cross attempt', { jobs: [rawJob(1, { run_attempt: 2 })], total_count: 1 }, null, /attempt mismatch/],
+    ['oversize', { jobs: [], total_count: 10001 }, null, /job pagination limit/],
+  ]
+  for (const [name, jobs, error, expected] of cases) {
+    const r = rawRun(1, error ? {} : { head_commit: { tree_id: 't' } })
+    const gh = provider(new Map([
+      ['repos/o/r', { default_branch: 'main' }], ['repos/o/r/actions/runs/1', r],
+      [jobsPath(1), jobs], [commitPath(r.head_sha), error],
+    ]))
+    await assert.rejects(fetchRun('o/r', 1, gh.api), expected, name)
+  }
+  const gh = provider(new Map())
+  await assert.rejects(fetchRuns('../bad', 1, gh.api), /--repo must be owner\/name/)
+  await assert.rejects(fetchRuns('o/r', 2001, gh.api), /--runs must be an integer/)
+  await assert.rejects(fetchRun('o/r', 0, gh.api), /--profile-run must be an integer/)
+  assert.deepEqual(gh.calls, [], 'validate before network access')
+})
+
+test('collector refuses changed page totals and an exhausted page budget but accepts an exact full final page', async () => {
+  const r = rawRun(1, { head_commit: { tree_id: 't' } })
+  const base = [['repos/o/r', { default_branch: 'main' }], ['repos/o/r/actions/runs/1', r]]
+  const page = (n) => Array.from({ length: 100 }, (_, i) => rawJob((n - 1) * 100 + i + 1))
+  const exact = provider(new Map([...base, [jobsPath(1), { total_count: 100, jobs: page(1) }]]))
+  const [full] = await fetchRun('o/r', 1, exact.api)
+  assert.deepEqual(full.jobs.map((j) => j.id), page(1).map((j) => j.id))
+  assert.equal(exact.calls.includes(jobsPath(1, 2)), false, 'no extra page required for a verified total')
+  const changed = provider(new Map([...base,
+    [jobsPath(1), { total_count: 101, jobs: page(1) }], [jobsPath(1, 2), { total_count: 102, jobs: [rawJob(101)] }],
+  ]))
+  await assert.rejects(fetchRun('o/r', 1, changed.api), /job total changed/)
+  const bounded = provider(new Map([...base, ...Array.from({ length: 100 }, (_, i) => [jobsPath(1, i + 1), { jobs: page(i + 1) }])]))
+  await assert.rejects(fetchRun('o/r', 1, bounded.api), /pagination limit reached.*refusing partial/)
+  assert.equal(bounded.calls.at(-1), jobsPath(1, 100))
+  assert.equal(bounded.calls.includes(jobsPath(1, 101)), false)
+})
+
+test('history pagination rejects duplicate runs rather than counting the same execution twice', async () => {
+  const r = rawRun(1)
+  const gh = provider(new Map([
+    ['repos/o/r', { default_branch: 'main' }], [historyPath(), { workflow_runs: [r, r] }],
+  ]))
+  await assert.rejects(fetchRuns('o/r', 2, gh.api), /duplicate run ID/)
+  assert.equal(gh.calls.some((p) => p.includes('/jobs?')), false)
+})
+
+const CLI = fileURLToPath(new URL('./ci-run-audit.mjs', import.meta.url))
+function cli(argv) {
+  return spawnSync(process.execPath, [CLI, ...argv], { encoding: 'utf8', timeout: 10000, env: { ...process.env, PATH: '' } })
+}
+function savedFixture(t, data) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ci-run-audit-'))
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }))
+  const file = path.join(dir, 'runs.json')
+  fs.writeFileSync(file, JSON.stringify(data))
+  return { dir, file }
+}
+
+test('saved-data CLI selects a run, reports all jobs including gates, saves raw rows, and remains re-auditable offline', (t) => {
+  const target = runOf({ id: 71, attempt: 3, sha: 's1', tree: null, url: 'https://github.com/o/r/actions/runs/71',
+    jobs: [job('unit', 'failure', 2, 5, 1), job('all-gates', 'failure', 7, 1)] })
+  const other = runOf({ id: 72, sha: 's2', tree: 't2', jobs: [job('lint', 'success', 0, 1)] })
+  const { dir, file } = savedFixture(t, [target, other]), save = path.join(dir, 'copied.json')
+  const result = cli(['--from', file, '--profile-run', '71', '--json', '--save', save])
+  assert.equal(result.status, 0, result.stderr)
+  assert.equal(result.stderr, '')
+  const p = JSON.parse(result.stdout)
+  assert.deepEqual([p.mode, p.runId, p.attempt, p.runUrl], ['profile', 71, 3, target.url])
+  assert.deepEqual(p.jobs.map((j) => j.name), ['unit', 'all-gates'])
+  assert.deepEqual([p.jobs[0].elapsedS, p.jobs[0].workS, p.jobs[0].setupS], [300, 240, 60])
+  assert.deepEqual(JSON.parse(fs.readFileSync(save, 'utf8')), [target, other])
+  const audit = cli(['--from', save, '--json', '--min-trees', '1'])
+  assert.equal(audit.status, 0, audit.stderr)
+  const a = JSON.parse(audit.stdout)
+  assert.equal(a.window.runs, 2)
+  assert.equal(a.yield.find((j) => j.job === 'unit').sole, 1)
+  assert.equal(a.yield.some((j) => j.job === 'all-gates'), false)
+  assert.equal(a.dataGaps.unknownTrees[0].runId, 71)
+  const markdown = cli(['--from', file, '--profile-run', '72'])
+  assert.equal(markdown.status, 0, markdown.stderr)
+  assert.match(markdown.stdout, /CI run profile: CI \/ 72/)
+  assert.doesNotMatch(markdown.stdout, /## unit/)
+})
+
+test('CLI validates options before fetch, rejects unsafe/unknown flags and reports useful errors without a stack trace', () => {
+  const cases = [
+    [[], /provide exactly one/],
+    [['--repo'], /missing value for --repo/],
+    [['--repo', '--json'], /missing value for --repo/],
+    [['--repo', 'https://github.com/o/r'], /--repo must be owner\/name/],
+    [['--repo', 'o/r', '--from', 'x'], /provide exactly one/],
+    [['--repo', 'o/r', '--runs', '0'], /--runs must be an integer/],
+    [['--repo', 'o/r', '--runs', '2001'], /--runs must be an integer/],
+    [['--repo', 'o/r', '--runs', '1.5'], /--runs must be an integer/],
+    [['--repo', 'o/r', '--runs', 'NaN'], /--runs must be an integer/],
+    [['--repo', 'o/r', '--min-trees', '0'], /--min-trees must be an integer/],
+    [['--repo', 'o/r', '--profile-run', '9007199254740992'], /--profile-run must be an integer/],
+    [['--repo', 'o/r', '--profile-run', '2', '--runs', '3'], /--runs is only supported/],
+    [['--from', 'x', '--runs', '3'], /--runs is only supported/],
+    [['--from', 'x', '--profile-run', '2', '--ignore-job', 'gate'], /audit-only/],
+    [['--from', 'x', '--ignore-job', '['], /Invalid regular expression/],
+    [['--from', 'x', '--json', '--json'], /duplicate argument/],
+    [['--unsafe-api', 'evil'], /unknown argument/],
+  ]
+  for (const [argv, error] of cases) {
+    const result = cli(argv)
+    assert.equal(result.status, 2, argv.join(' '))
+    assert.equal(result.stdout, '', argv.join(' '))
+    assert.match(result.stderr, error)
+    assert.doesNotMatch(result.stderr, /\n\s+at /)
+  }
+  const help = cli(['--help'])
+  assert.equal(help.status, 0, help.stderr)
+  assert.match(help.stderr, /--profile-run/)
+  const fetchFailure = cli(['--repo', 'o/r', '--profile-run', '1'])
+  assert.equal(fetchFailure.status, 2)
+  assert.match(fetchFailure.stderr, /gh ENOENT/)
+  assert.equal(fetchFailure.stdout, '')
+})
+
+test('saved-data CLI refuses malformed data, absent/ambiguous run IDs and unwritable output with no report', (t) => {
+  const { dir, file } = savedFixture(t, [])
+  const row = runOf({ id: 81, sha: 's', tree: 't', jobs: [job('unit', 'success', 0, 1)] })
+  const cases = [
+    ['{bad', [], /JSON/],
+    [JSON.stringify({ runs: [] }), [], /array of runs/],
+    [JSON.stringify([{ id: 1, workflow: 'CI', jobs: {} }]), [], /jobs array/],
+    [JSON.stringify([{ ...row, jobs: [{ name: 'unit', started: 'invalid date' }] }]), [], /invalid job started timestamp/],
+    [JSON.stringify([row]), ['--profile-run', '99'], /run 99 not found/],
+    [JSON.stringify([row, row]), ['--profile-run', '81'], /multiple records/],
+    [JSON.stringify([row]), ['--save', dir], /EISDIR/],
+  ]
+  for (const [data, flags, error] of cases) {
+    fs.writeFileSync(file, data)
+    const result = cli(['--from', file, ...flags])
+    assert.equal(result.status, 2, result.stderr)
+    assert.equal(result.stdout, '')
+    assert.match(result.stderr, error)
+    assert.doesNotMatch(result.stderr, /\n\s+at /)
+    assert.equal(fs.readFileSync(file, 'utf8'), data)
+  }
+  const missing = cli(['--from', path.join(dir, 'absent.json')])
+  assert.equal(missing.status, 2)
+  assert.match(missing.stderr, /ENOENT/)
+})

package/skills/cicd/github-flow/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO