@bongos/core 1.19.920 → 1.19.921

package/tests/skip_is_not_pass.mjs

@@ -28,6 +28,8 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { countSkips } from '../scripts/gds/run-unit-tests.js';
@@ -43,6 +45,52 @@ const SUITES = [
   { file: 'modules/security/tests/mirror.mjs', skips: 1 },
 ];
 
+// realSymlinkReason — why the CONTROL run cannot be evaluated here, or null (task 1004112).
+//
+// Every case below that passes `forceNoSymlink: true` is evaluable anywhere: it asks a suite to
+// take its skip path and checks the accounting. But the pair's second case also runs a CONTROL
+// (`forceNoSymlink: false`) and asserts `ran.skipped === 0` — "where symlinks work, nothing is
+// skipped". That carries an unstated precondition: symlinks work HERE.
+//
+// On Windows without Developer Mode they do not. A directory JUNCTION can be created, which is
+// why link cases elsewhere still run and the failure looks selective, but `fs.symlinkSync` refuses
+// with EPERM — so the control run legitimately skips, `ran.skipped` is 1 or 2 rather than 0, and
+// four cases go red over a platform fact nobody claimed.
+//
+// That is a FALSE FAIL, and it is this file's own defect in mirror image: a case that does not
+// apply to the platform, asserted anyway instead of skipped. The shape task 1004051 fixed in
+// tests/quarantine_canonical.mjs, and the inverse of the false PASS in task 1003993 that this file
+// exists to police. The file whose job is skip honesty was inferring its platform instead of
+// asking.
+//
+// So ASK, with the same probe the suites use (mirror.mjs `canSymlink`): try to make a real
+// symlink. Not `process.platform` — the question is a CAPABILITY, and Windows in Developer Mode
+// answers yes while a container without CAP_SYMLINK answers no.
+//
+// Returns a REASON for node:test's skip, never a bare early `return`, which prints as a pass and
+// is precisely the 1003993 defect.
+function realSymlinkReason() {
+  // Deliberately ignores BONGOS_TEST_FORCE_NO_SYMLINK: that hook is how this file ASKS a suite to
+  // take its skip path, and honouring it here would skip the control run on every box, deleting
+  // the coverage instead of gating it.
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'skip-is-not-pass-probe-'));
+  const target = path.join(dir, 'probe-target');
+  const link = path.join(dir, 'probe-link');
+  try {
+    fs.writeFileSync(target, 'probe', 'utf8');
+    fs.symlinkSync(target, link);
+    return null;
+  } catch (err) {
+    return 'this platform cannot create a REAL symlink '
+      + `(${err.code || err.message}), so the control run's own link cases skip too and `
+      + '"where symlinks work, nothing is skipped" cannot be evaluated here. On Windows, '
+      + 'Developer Mode or an elevated shell makes this case run.';
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+const NO_REAL_SYMLINK = realSymlinkReason();
+
 function runSuite(file, { forceNoSymlink }) {
   const env = { ...process.env, NODE_ENV: 'test' };
   if (forceNoSymlink) env.BONGOS_TEST_FORCE_NO_SYMLINK = '1';
@@ -65,7 +113,11 @@ for (const { file, skips } of SUITES) {
     assert.equal(r.failed, 0, 'a skip is not a failure');
   });
 
-  test(`${file}: THE BUG — skipped cases no longer inflate the passed count`, () => {
+  // The only case here that needs a real symlink: it compares the skip run against a CONTROL run
+  // in which nothing skips. Gated, not deleted — wherever symlinks work (every CI runner, Linux,
+  // macOS, Windows in Developer Mode) it asserts in full.
+  test(`${file}: THE BUG — skipped cases no longer inflate the passed count`,
+    { skip: NO_REAL_SYMLINK ?? false }, () => {
     // The heart of it. Under the old code BOTH runs printed the same pass count: the cases
     // that did not run were indistinguishable from the ones that did. If these two ever
     // agree again, the fake pass is back, whatever the summary line claims.
@@ -96,6 +148,31 @@ for (const { file, skips } of SUITES) {
   });
 }
 
+// THE SKIP HAS TO JUSTIFY ITSELF, or it is the defect this file polices.
+//
+// The gate above is the dangerous kind of fix: if `realSymlinkReason()` ever returns a reason on a
+// box where symlinks DO work, four cases quietly stop running and the suite still reads green —
+// task 1003993's false pass, reintroduced by the file written to prevent it. A skip is only honest
+// if its stated reason is TRUE.
+//
+// So each half checks the other, and exactly one of them runs on any given box:
+//
+//   - where the probe says it CANNOT symlink, the control run must genuinely skip. If the probe is
+//     lying, the control run skips nothing and this reds.
+//   - where the probe says it CAN, the four gated cases are running, and their own
+//     `ran.skipped === 0` is the same assertion from the other side.
+//
+// Neither box can verify the other's branch, which is why the reason is CHECKED rather than
+// trusted: "this platform cannot create a real symlink" is falsifiable right here.
+test('the skip reason is TRUE — a platform that claims it cannot symlink really does skip',
+  { skip: NO_REAL_SYMLINK ? false : 'symlinks work here, so the gated cases are running and assert it themselves' }, () => {
+  const ran = runSuite('modules/security/tests/mirror.mjs', { forceNoSymlink: false });
+  assert.ok(ran.skipped > 0,
+    'realSymlinkReason() claimed this platform cannot create a real symlink, but the control run '
+    + `skipped nothing (${ran.skipped}) — the probe is wrong and it is silently deleting the `
+    + 'coverage this file exists to protect');
+});
+
 test('sanitize_rebuild names both physical-confinement cases it lost', () => {
   // The two that matter most: they are the ONLY coverage of physical confinement, and the
   // pair whose silent absence let task 1003848 reach CI red.
@@ -119,3 +196,16 @@ test('the runner counts those SKIP lines, so a green roll-up still says coverage
   // NAME contains the word must not be miscounted.
   assert.equal(countSkips('  ok  refuses to SKIP a dangerous entry\n'), 0);
 });
+
+test('countSkips also reads node:test\'s own summary — otherwise THIS file\'s skips are invisible', () => {
+  // The gap this file's own fix opened (task 1004112). node:test suites print no SKIP lines; they
+  // report `ℹ skipped N`. Uncounted, the roll-up says "all passed" over unrun coverage — the
+  // 1003993 defect one layer up, and exactly what gating the four cases above would have caused.
+  assert.equal(countSkips('ℹ tests 15\nℹ pass 11\nℹ fail 0\nℹ skipped 4\nℹ todo 0\n'), 4);
+  assert.equal(countSkips('ℹ tests 3\nℹ pass 3\nℹ skipped 0\n'), 0);
+  // A suite printing both formats SUMS rather than picking one — under-reporting is the failure
+  // mode this counter exists to prevent.
+  assert.equal(countSkips('  SKIP one\n  SKIP two\nℹ skipped 3\n'), 5);
+  // The word in a case NAME must not be counted, same discipline as the SKIP line rule.
+  assert.equal(countSkips('  ok  reports how many it skipped 9\n'), 0);
+});