@bongos/core 1.17.0

package/tests/ship_ci_deploy.mjs

@@ -0,0 +1,374 @@
+// tests/ship_ci_deploy.mjs
+//
+// Unit tests for the 'ci' deploy mode added in #679 / ADR 0042 (let builders
+// self-deploy without the prod droplet SSH key: ship opens a PR + enables
+// GitHub auto-merge; .github/workflows/deploy-prod.yml deploys main->prod).
+//
+// These cover the PURE, exported helpers only — the live PR/auto-merge/deploy
+// path needs branch protection + an armed CI deploy and is operator-verified at
+// cutover. What we prove here:
+//   1. parseDeployMode precedence (env > config > default) and the SAFE DEFAULT
+//      ('laptop') for missing/malformed/unknown input — this default is what
+//      keeps the whole change inert until the deliberate cutover.
+//   2. buildPrCreateArgv carries the untrusted value_summary as ONE literal
+//      argv element (no shell splitting / interpretation), same guarantee the
+//      #681 buildMergeArgv test makes for the merge message.
+//   3. buildPrMergeArgv arms auto-merge with the project's --no-ff convention.
+//   4. deployRunSucceeded only confirms a COMPLETED+SUCCESS run for the EXACT
+//      merge commit — never a different sha, never an in-flight/failed run.
+//   5. config/deploy.json ships as 'laptop' (the committed switch is OFF).
+//
+// Run:  node tests/ship_ci_deploy.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ship = require('../scripts/gds/ship.js');
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+const { parseDeployMode, effectiveDeployMode, buildPrCreateArgv, buildPrMergeArgv, deployRunSucceeded, shouldBailOnFetchFailure, classifyLandOutcome, strandNextStep, pickStaleGateReviewRun, landPollAfterAutoMerge, reconciledCardStatus } = ship;
+
+// ---- 1. parseDeployMode precedence + safe default ----
+
+test('parseDeployMode: env "ci" wins over a laptop config file', () => {
+  assert.equal(parseDeployMode('ci', '{"mode":"laptop"}'), 'ci');
+});
+
+test('parseDeployMode: env "laptop" wins over a ci config file', () => {
+  assert.equal(parseDeployMode('laptop', '{"mode":"ci"}'), 'laptop');
+});
+
+test('parseDeployMode: config "ci" honored when env is empty', () => {
+  assert.equal(parseDeployMode('', '{"mode":"ci"}'), 'ci');
+  assert.equal(parseDeployMode(undefined, '{"mode":"ci"}'), 'ci');
+});
+
+test('parseDeployMode: env is case/space insensitive', () => {
+  assert.equal(parseDeployMode('  CI ', null), 'ci');
+  assert.equal(parseDeployMode('Laptop', null), 'laptop');
+});
+
+test('parseDeployMode: SAFE DEFAULT laptop on no input at all', () => {
+  assert.equal(parseDeployMode(undefined, null), 'laptop');
+  assert.equal(parseDeployMode('', ''), 'laptop');
+});
+
+test('parseDeployMode: SAFE DEFAULT laptop on malformed config JSON', () => {
+  assert.equal(parseDeployMode(undefined, '{not json'), 'laptop');
+});
+
+test('parseDeployMode: SAFE DEFAULT laptop on unknown mode strings', () => {
+  assert.equal(parseDeployMode('production', '{"mode":"yolo"}'), 'laptop');
+  assert.equal(parseDeployMode(undefined, '{"mode":""}'), 'laptop');
+  assert.equal(parseDeployMode(undefined, '{}'), 'laptop');
+});
+
+// ---- 2. buildPrCreateArgv: untrusted summary is ONE argv element ----
+
+test('buildPrCreateArgv: base/head + a clean title land as literal argv', () => {
+  const argv = buildPrCreateArgv('claude/feat-x', '#9: do the thing', 'body text');
+  assert.deepEqual(argv, [
+    'pr', 'create', '--head', 'claude/feat-x', '--base', 'main',
+    '--title', '#9: do the thing', '--body', 'body text',
+  ]);
+});
+
+test('buildPrCreateArgv: command-injection payload in title stays ONE element', () => {
+  // The exact shape of the #681 attack: a hostile value_summary. With execFileSync
+  // (shell:false) this string can never be interpreted — proving it survives as a
+  // single, verbatim argv element is the unit-level guarantee.
+  const evil = '$(touch /tmp/pwned) `rm -rf /` ; echo hi';
+  const argv = buildPrCreateArgv('br', evil, evil);
+  const titleIdx = argv.indexOf('--title') + 1;
+  const bodyIdx = argv.indexOf('--body') + 1;
+  assert.equal(argv[titleIdx], evil, 'title must be the verbatim payload, not split');
+  assert.equal(argv[bodyIdx], evil, 'body must be the verbatim payload, not split');
+  // No element other than the title/body may contain shell metacharacters from
+  // the payload — i.e. it was not spliced into a flag.
+  argv.forEach((el, i) => {
+    if (i !== titleIdx && i !== bodyIdx) {
+      assert.ok(!el.includes('rm -rf'), `argv[${i}] leaked the payload: ${el}`);
+    }
+  });
+});
+
+// ---- 3. buildPrMergeArgv ----
+
+test('buildPrMergeArgv: arms auto-merge with --no-ff merge + branch cleanup', () => {
+  assert.deepEqual(buildPrMergeArgv('claude/feat-x'), [
+    'pr', 'merge', '--auto', '--merge', '--delete-branch', 'claude/feat-x',
+  ]);
+});
+
+// ---- 3b. landPollAfterAutoMerge: an enable-failure still WAITS for the land ----
+// task 1718: shipping from a worktree makes `gh pr merge --auto` fail ('main' is
+// already used by worktree), but the server still lands the PR. The bug was that
+// ciLandLocal returned early (stranded at confirmed, no in-session shipped banner).
+// This locks in that enable-failure routes to the server poll, not a dead-end.
+
+test('landPollAfterAutoMerge: auto-merge armed → watch GitHub (pollCiDeploy)', () => {
+  assert.equal(landPollAfterAutoMerge(true), 'ci');
+});
+
+test('landPollAfterAutoMerge: enable FAILED (worktree/branch-protection) → poll the server, do NOT strand', () => {
+  assert.equal(landPollAfterAutoMerge(false), 'server',
+    'a failed auto-merge-enable must still wait for the server land (pollServerPublish), not return at confirmed');
+});
+
+// ---- 3c. reconciledCardStatus: the completion card reflects the in-session land ----
+// task 1719: finishShip is handed the pre-merge status ('confirmed'); after
+// mergeAndDeploy lands the task it re-reads the live status so the SHIPPED banner
+// renders in the shipping session (and no pending-land breadcrumb is written). This
+// locks in that only a live 'shipped' upgrades the card; everything else is preserved.
+
+test('reconciledCardStatus: live shipped → SHIPPED card (upgrades the pre-merge confirmed)', () => {
+  assert.equal(reconciledCardStatus('shipped', 'confirmed'), 'shipped');
+});
+
+test('reconciledCardStatus: land still pending (live confirmed) → keep confirmed (breadcrumb fallback)', () => {
+  assert.equal(reconciledCardStatus('confirmed', 'confirmed'), 'confirmed');
+});
+
+test('reconciledCardStatus: status read failed (null) → keep the pre-merge status, no false shipped', () => {
+  assert.equal(reconciledCardStatus(null, 'confirmed'), 'confirmed');
+  assert.equal(reconciledCardStatus(undefined, 'confirmed'), 'confirmed');
+});
+
+test('reconciledCardStatus: already shipped stays shipped', () => {
+  assert.equal(reconciledCardStatus('shipped', 'shipped'), 'shipped');
+});
+
+// ---- 4. deployRunSucceeded: strict match on the merge commit ----
+
+const SHA = 'abc123def456abc123def456abc123def456abcd';
+
+test('deployRunSucceeded: true only for completed+success on the exact sha', () => {
+  const runs = [{ headSha: SHA, status: 'completed', conclusion: 'success' }];
+  assert.equal(deployRunSucceeded(runs, SHA), true);
+});
+
+test('deployRunSucceeded: false for a different commit', () => {
+  const runs = [{ headSha: 'ffffffffffffffffffffffffffffffffffffffff', status: 'completed', conclusion: 'success' }];
+  assert.equal(deployRunSucceeded(runs, SHA), false);
+});
+
+test('deployRunSucceeded: false for an in-flight or failed run on the sha', () => {
+  assert.equal(deployRunSucceeded([{ headSha: SHA, status: 'in_progress', conclusion: null }], SHA), false);
+  assert.equal(deployRunSucceeded([{ headSha: SHA, status: 'completed', conclusion: 'failure' }], SHA), false);
+});
+
+test('deployRunSucceeded: false on empty/missing inputs', () => {
+  assert.equal(deployRunSucceeded([], SHA), false);
+  assert.equal(deployRunSucceeded(null, SHA), false);
+  assert.equal(deployRunSucceeded([{ headSha: SHA, status: 'completed', conclusion: 'success' }], null), false);
+});
+
+// ---- 5. the committed switch is LIVE on 'ci' (cutover landed: task 859, ADR 0042) ----
+
+test('config/deploy.json ships as ci (builder self-deploy cutover is ON)', () => {
+  const raw = fs.readFileSync(path.join(__dirname, '..', 'config', 'deploy.json'), 'utf8');
+  assert.equal(parseDeployMode(undefined, raw), 'ci',
+    'config/deploy.json ships as ci — builders self-deploy via PR auto-merge + Actions (task 859). ' +
+    'To roll back to operator-laptop deploys, set mode "laptop" AND disarm the PROD_DEPLOY_VIA_CI repo var.');
+});
+
+// ---- 6. shouldBailOnFetchFailure: the task-1037 dev-box publish fix ----
+//
+// autoMerge() ran `git fetch origin main` as a HARD precondition before
+// dispatching to the land path. A credential-less dev box (private origin,
+// scrubbed clone token — ADR 0053) can't fetch, so it bailed here and stranded
+// every ship at confirmed — never reaching the ADR-0055 server-mediated publish
+// built precisely for it (the bug task 1027 surfaced). The fix makes a fetch
+// failure fatal ONLY off the server path. Truth table, proven without git:
+
+test('shouldBailOnFetchFailure: fetch OK never bails (regardless of path)', () => {
+  assert.equal(shouldBailOnFetchFailure(true, 'ci', 'server'), false);
+  assert.equal(shouldBailOnFetchFailure(true, 'ci', 'local'), false);
+  assert.equal(shouldBailOnFetchFailure(true, 'laptop', 'local'), false);
+});
+
+test('shouldBailOnFetchFailure: fetch FAILED on the dev-box server path does NOT bail', () => {
+  // The fix: ci + server (a credential-less box) proceeds to ciLandServer, which
+  // bundles against the local origin/main while the server tops up main.
+  assert.equal(shouldBailOnFetchFailure(false, 'ci', 'server'), false);
+});
+
+test('shouldBailOnFetchFailure: fetch FAILED off the server path still bails (laptop unchanged)', () => {
+  // A laptop has creds; a real fetch failure there is a genuine problem -> bail to
+  // /merge-mode, exactly as before. Same for laptop deploy mode.
+  assert.equal(shouldBailOnFetchFailure(false, 'ci', 'local'), true);
+  assert.equal(shouldBailOnFetchFailure(false, 'laptop', 'server'), true);
+  assert.equal(shouldBailOnFetchFailure(false, 'laptop', 'local'), true);
+});
+
+// ---- 7. classifyLandOutcome: a successful-but-still-running publish is NOT a failure (task 1049) ----
+//
+// The #1027 retrospective: the ship's poll window is shorter than real CI, so a
+// PR that was opened + auto-merge-armed (a success) printed "did not merge —
+// task stays at confirmed" and READ AS A FAILURE. classifyLandOutcome draws the
+// line: only a CLOSED-without-merge PR is a failure; an armed/merging PR is
+// 'pending' (it lands on its own), and merged+deployed is 'shipped'.
+
+test('classifyLandOutcome: merged + deploy success → shipped', () => {
+  assert.equal(classifyLandOutcome({ pr_state: 'closed', merged: true, deploy_status: 'success' }), 'shipped');
+});
+
+test('classifyLandOutcome: PR closed WITHOUT merging → failed (the only failure)', () => {
+  assert.equal(classifyLandOutcome({ prState: 'closed', merged: false, deploy_status: 'none' }), 'failed');
+  // accepts pr_state or prState key (route uses pr_state)
+  assert.equal(classifyLandOutcome({ pr_state: 'closed', merged: false }), 'failed');
+});
+
+test('classifyLandOutcome: PR open + armed (not merged) → pending, NOT failed', () => {
+  assert.equal(classifyLandOutcome({ pr_state: 'open', merged: false, deploy_status: 'pending' }), 'pending');
+});
+
+test('classifyLandOutcome: merged but deploy not yet confirmed → pending', () => {
+  assert.equal(classifyLandOutcome({ pr_state: 'open', merged: true, deploy_status: 'pending' }), 'pending');
+});
+
+test('classifyLandOutcome: empty/none status → pending (never a false failure)', () => {
+  assert.equal(classifyLandOutcome({ pr_state: 'none', merged: false, deploy_status: 'none' }), 'pending');
+});
+
+// ---- 8. strandNextStep: box-aware recovery guidance, never gh-only /merge-mode on a box (task 1052) ----
+// The #1027 retrospective: a confirmed-strand on a dev box pointed the builder at
+// /merge-mode, which needs gh + a main checkout a box lacks — a dead end.
+
+test('strandNextStep: a dev box (via "server") is pointed at resume, NOT /merge-mode', () => {
+  const s = strandNextStep(1027, 'server');
+  assert.match(s, /ship\.js 1027/, 'names the resume command with the task id');
+  assert.match(s, /resume|resumes/i);
+  assert.match(s, /NOT available/, 'explicitly says /merge-mode is not available on a box');
+});
+
+test('strandNextStep: a laptop (via "local") keeps /merge-mode, with resume as the alternative', () => {
+  const s = strandNextStep(1027, 'local');
+  assert.match(s, /merge-mode/, 'laptop can use /merge-mode');
+  assert.match(s, /ship\.js 1027/, 'and resume is offered as the alternative');
+});
+
+test('task 1046: regenerateDiagrams SKIPS on the dev-box (server-publish) path and leaves the tree untouched', () => {
+  const { execSync } = require('node:child_process');
+  const ROOT = path.resolve(__dirname, '..');
+  const status = () => execSync('git status --porcelain docs/onboarding/diagrams', { cwd: ROOT }).toString();
+  const before = status();
+  const prev = process.env.OTB_PUSH_VIA_SERVER;
+  process.env.OTB_PUSH_VIA_SERVER = '1'; // force pushVia()==='server' (a credential-less dev box)
+  try {
+    // On a box there is no headless browser; attempting the render strands the
+    // regenerated .mmd + assertions.json UNCOMMITTED in the tree (#1046). The
+    // guard must return early BEFORE any regen/render, so the call is a pure no-op.
+    assert.equal(ship.regenerateDiagrams(), 'skipped-server',
+      'on a dev box the diagram regen must skip entirely (no render attempt)');
+  } finally {
+    if (prev === undefined) delete process.env.OTB_PUSH_VIA_SERVER;
+    else process.env.OTB_PUSH_VIA_SERVER = prev;
+  }
+  assert.equal(status(), before,
+    '#1046: the dev-box skip must not write or stage any diagram artifact (no uncommitted .mmd/assertions left behind)');
+});
+
+// ---- 9. pickStaleGateReviewRun: the gate-author-trust re-run nudge (task 1169) ----
+//
+// On the laptop ci-land path, ship.js posts the gate-author-trust attestation
+// between push and PR-open so a FRESH gate-surface PR auto-passes ADR-0058's
+// gate-review. But a REUSED open PR may already carry a red gate-review run on the
+// same head SHA (it ran before the attestation existed), and a new commit status
+// does NOT re-trigger a pull_request check — so ship.js re-runs that stale run.
+// pickStaleGateReviewRun is the pure picker: a COMPLETED, non-success run on THIS
+// head SHA → its databaseId; anything else (no run, in-flight, already green) → null.
+
+const GSHA = 'aa11bb22cc33';
+
+test('pickStaleGateReviewRun: a completed-failed run on the head SHA → its databaseId', () => {
+  const runs = [
+    { databaseId: 42, headSha: GSHA, status: 'completed', conclusion: 'failure' },
+    { databaseId: 43, headSha: 'other', status: 'completed', conclusion: 'success' },
+  ];
+  assert.equal(pickStaleGateReviewRun(runs, GSHA), 42);
+});
+
+test('pickStaleGateReviewRun: a cancelled/timed_out run on the head SHA is also stale', () => {
+  assert.equal(pickStaleGateReviewRun([{ databaseId: 7, headSha: GSHA, status: 'completed', conclusion: 'cancelled' }], GSHA), 7);
+  assert.equal(pickStaleGateReviewRun([{ databaseId: 8, headSha: GSHA, status: 'completed', conclusion: 'timed_out' }], GSHA), 8);
+});
+
+test('pickStaleGateReviewRun: an already-green run → null (nothing to re-run)', () => {
+  assert.equal(pickStaleGateReviewRun([{ databaseId: 9, headSha: GSHA, status: 'completed', conclusion: 'success' }], GSHA), null);
+});
+
+test('pickStaleGateReviewRun: an in-flight run → null (no re-run; it reads the attestation on its own)', () => {
+  assert.equal(pickStaleGateReviewRun([{ databaseId: 10, headSha: GSHA, status: 'in_progress', conclusion: null }], GSHA), null);
+  assert.equal(pickStaleGateReviewRun([{ databaseId: 11, headSha: GSHA, status: 'queued', conclusion: null }], GSHA), null);
+});
+
+test('pickStaleGateReviewRun: a failed run on a DIFFERENT sha is ignored (only the current head)', () => {
+  assert.equal(pickStaleGateReviewRun([{ databaseId: 12, headSha: 'deadbeef', status: 'completed', conclusion: 'failure' }], GSHA), null);
+});
+
+test('pickStaleGateReviewRun: empty/missing inputs → null (never re-runs blindly)', () => {
+  assert.equal(pickStaleGateReviewRun([], GSHA), null);
+  assert.equal(pickStaleGateReviewRun(null, GSHA), null);
+  assert.equal(pickStaleGateReviewRun([{ databaseId: 1, headSha: GSHA, status: 'completed', conclusion: 'failure' }], null), null);
+});
+
+// ---- 10. effectiveDeployMode: a credential-less machine never strands on a stale 'laptop' (task 1449) ----
+//
+// The bug scootermack hit 2026-06-22: his checkout's config/deploy.json was still
+// at the pre-cutover 'laptop' default, and his machine had no gh/token/ssh — and
+// couldn't `git pull` to refresh it. resolveDeployMode() trusted the stale file
+// and returned 'laptop', so ship attempted the laptop land (push main + SSH the
+// droplet) which a credential-less machine CANNOT do → stranded at merge, never
+// reaching the ADR-0055 server path (pushVia() already routes there). The fix
+// makes the parsed mode credential-aware, mirroring pushVia(). Truth table, proven
+// without spawning gh or touching fs:
+
+test('effectiveDeployMode: laptop + cannot push locally + not env-forced → ci (the fix)', () => {
+  assert.equal(effectiveDeployMode('laptop', { canPushLocally: false, envForced: false }), 'ci');
+});
+
+test('effectiveDeployMode: laptop + cannot push but ENV-FORCED → laptop (explicit override wins)', () => {
+  // OTB_DEPLOY_MODE=laptop is honored even on a box — tests/staging may force it.
+  assert.equal(effectiveDeployMode('laptop', { canPushLocally: false, envForced: true }), 'laptop');
+});
+
+test('effectiveDeployMode: laptop + CAN push locally → laptop (a real authed laptop is unchanged)', () => {
+  assert.equal(effectiveDeployMode('laptop', { canPushLocally: true, envForced: false }), 'laptop');
+  assert.equal(effectiveDeployMode('laptop', { canPushLocally: true, envForced: true }), 'laptop');
+});
+
+test('effectiveDeployMode: ci is always ci, regardless of push capability', () => {
+  assert.equal(effectiveDeployMode('ci', { canPushLocally: false, envForced: false }), 'ci');
+  assert.equal(effectiveDeployMode('ci', { canPushLocally: true, envForced: false }), 'ci');
+  assert.equal(effectiveDeployMode('ci', { canPushLocally: false, envForced: true }), 'ci');
+});
+
+test('effectiveDeployMode: tolerates a missing options object (defaults to no fallback)', () => {
+  // Defensive: called with just a mode → never throws; only the explicit
+  // (laptop + !envForced + !canPushLocally) triple triggers the fallback.
+  assert.equal(effectiveDeployMode('ci'), 'ci');
+  assert.equal(effectiveDeployMode('laptop'), 'ci'); // canPushLocally undefined ⇒ falsy ⇒ fall back
+});
+
+console.log('');
+console.log(`ship_ci_deploy: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);