@continuous-excellence/ze-great-dashboard-aws 0.31.54 → 0.31.56

package/dist/cli.js

@@ -205,11 +205,11 @@ var panelSchema = z2.looseObject({
         path: ["test_results"],
         message: "test-count requires test_results artifact configuration"
       });
-  } else if (panel.test_results) {
+  } else if (panel.test_results && panel.type !== "pipeline-status") {
     ctx.addIssue({
       code: "custom",
       path: ["test_results"],
-      message: "test_results is only supported by test-count panels"
+      message: "test_results is only supported by test-count and pipeline-status panels"
     });
   }
   if (panel.type !== "http-value") return;
@@ -454,6 +454,12 @@ var boardConfigSchema = z2.object({
           }
         });
       }
+      if (panel.type === "pipeline-status" && panel.test_results && source?.type !== "github-actions")
+        ctx.addIssue({
+          code: "custom",
+          path: ["boards", boardName, "panels", panelIndex, "test_results"],
+          message: "test_results requires a github-actions source"
+        });
       if (panel.type !== "pipeline-status" || source?.type !== "azure-devops") return;
       if (typeof panel.pipeline !== "number" || !Number.isInteger(panel.pipeline) || panel.pipeline <= 0) {
         ctx.addIssue({
@@ -566,11 +572,29 @@ var pipelineActivitySchema = z4.object({
   name: z4.string().min(1),
   parent: z4.string().min(1).optional()
 });
+var testCountSchema = z4.discriminatedUnion("status", [
+  z4.object({
+    type: z4.literal("test-count"),
+    status: z4.literal("reported"),
+    total: z4.number().int().nonnegative(),
+    passed: z4.number().int().nonnegative().optional(),
+    failed: z4.number().int().nonnegative().optional(),
+    skipped: z4.number().int().nonnegative().optional()
+  }),
+  z4.object({ type: z4.literal("test-count"), status: z4.literal("pending") }),
+  z4.object({ type: z4.literal("test-count"), status: z4.literal("not-reported") })
+]);
+var testEvidenceSchema = z4.discriminatedUnion("state", [
+  z4.object({ state: z4.literal("ok"), observedAt: z4.iso.datetime(), signal: testCountSchema }),
+  z4.object({ state: z4.literal("error"), observedAt: z4.iso.datetime(), error: envelopeErrorSchema })
+]);
 var pipelineStatusSchema = z4.object({
   type: z4.literal("pipeline-status"),
   status: z4.enum(["passed", "failed", "warning", "running", "cancelled", "unknown"]),
   /** The source's unmodified status/result vocabulary, for an honest display. */
   rawStatus: z4.string(),
+  /** Test evidence bound to this exact run; failures do not erase build status. */
+  testResults: testEvidenceSchema.optional(),
   name: z4.string().min(1),
   /** The branch represented by this status, when the upstream supplies or filters by one. */
   branch: z4.string().min(1).optional(),
@@ -587,18 +611,6 @@ var pipelineStatusSchema = z4.object({
   /** When this workflow run was last updated by its source, distinct from our observation time. */
   sourceUpdatedAt: z4.iso.datetime().optional()
 });
-var testCountSchema = z4.discriminatedUnion("status", [
-  z4.object({
-    type: z4.literal("test-count"),
-    status: z4.literal("reported"),
-    total: z4.number().int().nonnegative(),
-    passed: z4.number().int().nonnegative().optional(),
-    failed: z4.number().int().nonnegative().optional(),
-    skipped: z4.number().int().nonnegative().optional()
-  }),
-  z4.object({ type: z4.literal("test-count"), status: z4.literal("pending") }),
-  z4.object({ type: z4.literal("test-count"), status: z4.literal("not-reported") })
-]);
 var pullRequestHealthItemSchema = z4.object({
   label: z4.string().min(1),
   status: pipelineStatusSchema.shape.status,
@@ -1545,6 +1557,7 @@ function concat(chunks, length) {
 
 // packages/server/src/adapters/github-actions.ts
 var pipelinePanelSchema = z7.object({
+  test_results: testResultsArtifactSchema.optional(),
   id: z7.string().min(1),
   type: z7.literal("pipeline-status"),
   source: z7.string().min(1),
@@ -1620,37 +1633,60 @@ function testCountCapabilities(panel, source) {
 async function fetchGithubActionsTestCount(args2) {
   const { panel, source } = testCountCapabilities(args2.panel, args2.source);
   const githubClient = githubClientFor(args2);
-  const noValidators = new Headers();
-  let failureLink = sourceLinkForWorkflow(source, panel.pipeline);
-  let failureObservedAt;
   try {
     const selected = await selectGithubWorkflowRun({
       ...args2,
       source,
       workflow: panel.pipeline,
-      requestHeaders: noValidators,
+      requestHeaders: new Headers(),
       githubClient
     });
     if (!selected.response.ok) return testCountFailure(panel.id, source, selected.response);
-    const { run: run2 } = selected;
-    if (!run2?.id)
+    if (!selected.run?.id)
       return testCountEnvelope(
         noRunEnvelope(panel.id, source, panel.pipeline, selected.response.headers.get("date"))
       );
-    const link = run2.html_url;
-    const runObservedAt = selected.observedAt;
-    failureLink = link;
-    failureObservedAt = runObservedAt;
+    const evidence = await readGithubRunTestEvidence(
+      { ...args2, source, githubClient },
+      {
+        run: selected.run,
+        observedAt: selected.observedAt
+      },
+      panel.test_results
+    );
+    return testCountEnvelope({ ...evidence, panelId: panel.id, link: selected.run.html_url });
+  } catch (error) {
+    return testCountEnvelope(
+      errorEnvelope(
+        panel.id,
+        error instanceof GithubAuthenticationError ? "unauthorized" : "upstream-error",
+        error,
+        sourceLinkForWorkflow(source, panel.pipeline)
+      )
+    );
+  }
+}
+async function readGithubRunTestEvidence(args2, selected, artifactConfig) {
+  const { run: run2, observedAt: runObservedAt } = selected;
+  const { source, githubClient } = args2;
+  const noValidators = new Headers();
+  let failureObservedAt = runObservedAt;
+  const evidenceError = (kind, at = failureObservedAt) => ({
+    state: "error",
+    observedAt: at,
+    error: { kind, message: publicErrorMessage(kind) }
+  });
+  const failedResponse = (response) => evidenceError(errorKind(response.status), observedAt2(response.headers.get("date")));
+  try {
+    if (!run2.id) return evidenceError("upstream-error");
     if (run2.status !== "completed")
-      return testCountEnvelope({
-        panelId: panel.id,
+      return {
         state: "ok",
         observedAt: runObservedAt,
-        link,
         signal: { type: "test-count", status: "pending" }
-      });
+      };
     const artifactsResponse = await githubFetch(
-      githubArtifactsCall(source, run2.id, panel.test_results),
+      githubArtifactsCall(source, run2.id, artifactConfig),
       {
         ...args2,
         source,
@@ -1658,57 +1694,37 @@ async function fetchGithubActionsTestCount(args2) {
         githubClient
       }
     );
-    if (!artifactsResponse.ok) return testCountFailure(panel.id, source, artifactsResponse, link);
+    if (!artifactsResponse.ok) return failedResponse(artifactsResponse);
     const artifactObservedAt = observedAt2(artifactsResponse.headers.get("date"));
     failureObservedAt = oldestObservation(runObservedAt, artifactObservedAt);
     const artifacts = artifactsSchema.parse(await artifactsResponse.json()).artifacts;
-    const matches = artifacts.filter((artifact2) => artifact2.name === panel.test_results.artifact);
+    const matches = artifacts.filter((artifact2) => artifact2.name === artifactConfig.artifact);
     if (matches.length === 0)
-      return testCountEnvelope({
-        panelId: panel.id,
+      return {
         state: "ok",
         observedAt: oldestObservation(runObservedAt, artifactObservedAt),
-        link,
         signal: { type: "test-count", status: "not-reported" }
-      });
-    if (matches.length !== 1 || matches[0]?.expired)
-      return testCountEnvelope(
-        errorEnvelope(
-          panel.id,
-          "upstream-error",
-          "The test-results artifact is unavailable.",
-          link
-        )
-      );
+      };
     const [artifact] = matches;
-    if (!artifact)
-      return testCountEnvelope(
-        errorEnvelope(
-          panel.id,
-          "upstream-error",
-          "The test-results artifact is unavailable.",
-          link
-        )
-      );
+    if (matches.length !== 1 || !artifact || artifact.expired)
+      return evidenceError("upstream-error");
     const archiveResponse = await githubFetch(githubArtifactDownloadCall(source, artifact.id), {
       ...args2,
       source,
       requestHeaders: noValidators,
       githubClient
     });
-    if (!archiveResponse.ok) return testCountFailure(panel.id, source, archiveResponse, link);
+    if (!archiveResponse.ok) return failedResponse(archiveResponse);
     const archiveObservedAt = observedAt2(archiveResponse.headers.get("date"));
     failureObservedAt = oldestObservation(runObservedAt, artifactObservedAt, archiveObservedAt);
     const summary = testResultsSummarySchema.parse(
-      JSON.parse(await readTestResultsArtifact(archiveResponse, panel.test_results.entry))
+      JSON.parse(await readTestResultsArtifact(archiveResponse, artifactConfig.entry))
     );
     if (summary.runId !== run2.id || summary.runAttempt !== run2.run_attempt || summary.headSha !== run2.head_sha)
       throw new Error("Test-results manifest does not belong to the selected workflow run.");
-    return testCountEnvelope({
-      panelId: panel.id,
+    return {
       state: "ok",
       observedAt: oldestObservation(runObservedAt, artifactObservedAt, archiveObservedAt),
-      link,
       signal: {
         type: "test-count",
         status: "reported",
@@ -1717,16 +1733,10 @@ async function fetchGithubActionsTestCount(args2) {
         ...summary.failed === void 0 ? {} : { failed: summary.failed },
         ...summary.skipped === void 0 ? {} : { skipped: summary.skipped }
       }
-    });
+    };
   } catch (error) {
-    return testCountEnvelope(
-      errorEnvelope(
-        panel.id,
-        error instanceof GithubAuthenticationError ? "unauthorized" : "upstream-error",
-        error,
-        failureLink,
-        failureObservedAt
-      )
+    return evidenceError(
+      error instanceof GithubAuthenticationError ? "unauthorized" : "upstream-error"
     );
   }
 }
@@ -1767,6 +1777,7 @@ async function fetchGithubActionsPipeline(args2) {
       ...args2,
       source: parsedSource,
       workflow: parsedPanel.pipeline,
+      requestHeaders: parsedPanel.test_results ? new Headers() : args2.requestHeaders,
       githubClient
     });
   } catch (error) {
@@ -1831,14 +1842,21 @@ async function fetchGithubActionsPipeline(args2) {
       });
       if (activity) signal.activity = activity;
     }
+    if (parsedPanel.test_results) {
+      signal.testResults = await readGithubRunTestEvidence(
+        { ...args2, source: parsedSource, githubClient },
+        { run: run2, observedAt: selected.observedAt },
+        parsedPanel.test_results
+      );
+    }
     const envelope = {
       panelId: args2.panel.id,
       state: "ok",
-      observedAt: observedAt2(upstream.headers.get("date")),
+      observedAt: signal.testResults ? oldestObservation(selected.observedAt, signal.testResults.observedAt) : selected.observedAt,
       link: run2.html_url,
       signal
     };
-    return { envelope, response: upstream };
+    return { envelope, response: parsedPanel.test_results ? new Response(null) : upstream };
   } catch (error) {
     return {
       response: new Response(

package/dist/index.js

@@ -887,11 +887,11 @@ var panelSchema = z2.looseObject({
         path: ["test_results"],
         message: "test-count requires test_results artifact configuration"
       });
-  } else if (panel.test_results) {
+  } else if (panel.test_results && panel.type !== "pipeline-status") {
     ctx.addIssue({
       code: "custom",
       path: ["test_results"],
-      message: "test_results is only supported by test-count panels"
+      message: "test_results is only supported by test-count and pipeline-status panels"
     });
   }
   if (panel.type !== "http-value") return;
@@ -1136,6 +1136,12 @@ var boardConfigSchema = z2.object({
           }
         });
       }
+      if (panel.type === "pipeline-status" && panel.test_results && source?.type !== "github-actions")
+        ctx.addIssue({
+          code: "custom",
+          path: ["boards", boardName, "panels", panelIndex, "test_results"],
+          message: "test_results requires a github-actions source"
+        });
       if (panel.type !== "pipeline-status" || source?.type !== "azure-devops") return;
       if (typeof panel.pipeline !== "number" || !Number.isInteger(panel.pipeline) || panel.pipeline <= 0) {
         ctx.addIssue({
@@ -1248,11 +1254,29 @@ var pipelineActivitySchema = z4.object({
   name: z4.string().min(1),
   parent: z4.string().min(1).optional()
 });
+var testCountSchema = z4.discriminatedUnion("status", [
+  z4.object({
+    type: z4.literal("test-count"),
+    status: z4.literal("reported"),
+    total: z4.number().int().nonnegative(),
+    passed: z4.number().int().nonnegative().optional(),
+    failed: z4.number().int().nonnegative().optional(),
+    skipped: z4.number().int().nonnegative().optional()
+  }),
+  z4.object({ type: z4.literal("test-count"), status: z4.literal("pending") }),
+  z4.object({ type: z4.literal("test-count"), status: z4.literal("not-reported") })
+]);
+var testEvidenceSchema = z4.discriminatedUnion("state", [
+  z4.object({ state: z4.literal("ok"), observedAt: z4.iso.datetime(), signal: testCountSchema }),
+  z4.object({ state: z4.literal("error"), observedAt: z4.iso.datetime(), error: envelopeErrorSchema })
+]);
 var pipelineStatusSchema = z4.object({
   type: z4.literal("pipeline-status"),
   status: z4.enum(["passed", "failed", "warning", "running", "cancelled", "unknown"]),
   /** The source's unmodified status/result vocabulary, for an honest display. */
   rawStatus: z4.string(),
+  /** Test evidence bound to this exact run; failures do not erase build status. */
+  testResults: testEvidenceSchema.optional(),
   name: z4.string().min(1),
   /** The branch represented by this status, when the upstream supplies or filters by one. */
   branch: z4.string().min(1).optional(),
@@ -1269,18 +1293,6 @@ var pipelineStatusSchema = z4.object({
   /** When this workflow run was last updated by its source, distinct from our observation time. */
   sourceUpdatedAt: z4.iso.datetime().optional()
 });
-var testCountSchema = z4.discriminatedUnion("status", [
-  z4.object({
-    type: z4.literal("test-count"),
-    status: z4.literal("reported"),
-    total: z4.number().int().nonnegative(),
-    passed: z4.number().int().nonnegative().optional(),
-    failed: z4.number().int().nonnegative().optional(),
-    skipped: z4.number().int().nonnegative().optional()
-  }),
-  z4.object({ type: z4.literal("test-count"), status: z4.literal("pending") }),
-  z4.object({ type: z4.literal("test-count"), status: z4.literal("not-reported") })
-]);
 var pullRequestHealthItemSchema = z4.object({
   label: z4.string().min(1),
   status: pipelineStatusSchema.shape.status,
@@ -2227,6 +2239,7 @@ function concat(chunks, length) {
 
 // packages/server/src/adapters/github-actions.ts
 var pipelinePanelSchema = z7.object({
+  test_results: testResultsArtifactSchema.optional(),
   id: z7.string().min(1),
   type: z7.literal("pipeline-status"),
   source: z7.string().min(1),
@@ -2302,37 +2315,60 @@ function testCountCapabilities(panel, source) {
 async function fetchGithubActionsTestCount(args) {
   const { panel, source } = testCountCapabilities(args.panel, args.source);
   const githubClient = githubClientFor(args);
-  const noValidators = new Headers();
-  let failureLink = sourceLinkForWorkflow(source, panel.pipeline);
-  let failureObservedAt;
   try {
     const selected = await selectGithubWorkflowRun({
       ...args,
       source,
       workflow: panel.pipeline,
-      requestHeaders: noValidators,
+      requestHeaders: new Headers(),
       githubClient
     });
     if (!selected.response.ok) return testCountFailure(panel.id, source, selected.response);
-    const { run } = selected;
-    if (!run?.id)
+    if (!selected.run?.id)
       return testCountEnvelope(
         noRunEnvelope(panel.id, source, panel.pipeline, selected.response.headers.get("date"))
       );
-    const link = run.html_url;
-    const runObservedAt = selected.observedAt;
-    failureLink = link;
-    failureObservedAt = runObservedAt;
+    const evidence = await readGithubRunTestEvidence(
+      { ...args, source, githubClient },
+      {
+        run: selected.run,
+        observedAt: selected.observedAt
+      },
+      panel.test_results
+    );
+    return testCountEnvelope({ ...evidence, panelId: panel.id, link: selected.run.html_url });
+  } catch (error) {
+    return testCountEnvelope(
+      errorEnvelope(
+        panel.id,
+        error instanceof GithubAuthenticationError ? "unauthorized" : "upstream-error",
+        error,
+        sourceLinkForWorkflow(source, panel.pipeline)
+      )
+    );
+  }
+}
+async function readGithubRunTestEvidence(args, selected, artifactConfig) {
+  const { run, observedAt: runObservedAt } = selected;
+  const { source, githubClient } = args;
+  const noValidators = new Headers();
+  let failureObservedAt = runObservedAt;
+  const evidenceError = (kind, at = failureObservedAt) => ({
+    state: "error",
+    observedAt: at,
+    error: { kind, message: publicErrorMessage(kind) }
+  });
+  const failedResponse = (response) => evidenceError(errorKind(response.status), observedAt2(response.headers.get("date")));
+  try {
+    if (!run.id) return evidenceError("upstream-error");
     if (run.status !== "completed")
-      return testCountEnvelope({
-        panelId: panel.id,
+      return {
         state: "ok",
         observedAt: runObservedAt,
-        link,
         signal: { type: "test-count", status: "pending" }
-      });
+      };
     const artifactsResponse = await githubFetch(
-      githubArtifactsCall(source, run.id, panel.test_results),
+      githubArtifactsCall(source, run.id, artifactConfig),
       {
         ...args,
         source,
@@ -2340,57 +2376,37 @@ async function fetchGithubActionsTestCount(args) {
         githubClient
       }
     );
-    if (!artifactsResponse.ok) return testCountFailure(panel.id, source, artifactsResponse, link);
+    if (!artifactsResponse.ok) return failedResponse(artifactsResponse);
     const artifactObservedAt = observedAt2(artifactsResponse.headers.get("date"));
     failureObservedAt = oldestObservation(runObservedAt, artifactObservedAt);
     const artifacts = artifactsSchema.parse(await artifactsResponse.json()).artifacts;
-    const matches = artifacts.filter((artifact2) => artifact2.name === panel.test_results.artifact);
+    const matches = artifacts.filter((artifact2) => artifact2.name === artifactConfig.artifact);
     if (matches.length === 0)
-      return testCountEnvelope({
-        panelId: panel.id,
+      return {
         state: "ok",
         observedAt: oldestObservation(runObservedAt, artifactObservedAt),
-        link,
         signal: { type: "test-count", status: "not-reported" }
-      });
-    if (matches.length !== 1 || matches[0]?.expired)
-      return testCountEnvelope(
-        errorEnvelope(
-          panel.id,
-          "upstream-error",
-          "The test-results artifact is unavailable.",
-          link
-        )
-      );
+      };
     const [artifact] = matches;
-    if (!artifact)
-      return testCountEnvelope(
-        errorEnvelope(
-          panel.id,
-          "upstream-error",
-          "The test-results artifact is unavailable.",
-          link
-        )
-      );
+    if (matches.length !== 1 || !artifact || artifact.expired)
+      return evidenceError("upstream-error");
     const archiveResponse = await githubFetch(githubArtifactDownloadCall(source, artifact.id), {
       ...args,
       source,
       requestHeaders: noValidators,
       githubClient
     });
-    if (!archiveResponse.ok) return testCountFailure(panel.id, source, archiveResponse, link);
+    if (!archiveResponse.ok) return failedResponse(archiveResponse);
     const archiveObservedAt = observedAt2(archiveResponse.headers.get("date"));
     failureObservedAt = oldestObservation(runObservedAt, artifactObservedAt, archiveObservedAt);
     const summary = testResultsSummarySchema.parse(
-      JSON.parse(await readTestResultsArtifact(archiveResponse, panel.test_results.entry))
+      JSON.parse(await readTestResultsArtifact(archiveResponse, artifactConfig.entry))
     );
     if (summary.runId !== run.id || summary.runAttempt !== run.run_attempt || summary.headSha !== run.head_sha)
       throw new Error("Test-results manifest does not belong to the selected workflow run.");
-    return testCountEnvelope({
-      panelId: panel.id,
+    return {
       state: "ok",
       observedAt: oldestObservation(runObservedAt, artifactObservedAt, archiveObservedAt),
-      link,
       signal: {
         type: "test-count",
         status: "reported",
@@ -2399,16 +2415,10 @@ async function fetchGithubActionsTestCount(args) {
         ...summary.failed === void 0 ? {} : { failed: summary.failed },
         ...summary.skipped === void 0 ? {} : { skipped: summary.skipped }
       }
-    });
+    };
   } catch (error) {
-    return testCountEnvelope(
-      errorEnvelope(
-        panel.id,
-        error instanceof GithubAuthenticationError ? "unauthorized" : "upstream-error",
-        error,
-        failureLink,
-        failureObservedAt
-      )
+    return evidenceError(
+      error instanceof GithubAuthenticationError ? "unauthorized" : "upstream-error"
     );
   }
 }
@@ -2449,6 +2459,7 @@ async function fetchGithubActionsPipeline(args) {
       ...args,
       source: parsedSource,
       workflow: parsedPanel.pipeline,
+      requestHeaders: parsedPanel.test_results ? new Headers() : args.requestHeaders,
       githubClient
     });
   } catch (error) {
@@ -2513,14 +2524,21 @@ async function fetchGithubActionsPipeline(args) {
       });
       if (activity) signal.activity = activity;
     }
+    if (parsedPanel.test_results) {
+      signal.testResults = await readGithubRunTestEvidence(
+        { ...args, source: parsedSource, githubClient },
+        { run, observedAt: selected.observedAt },
+        parsedPanel.test_results
+      );
+    }
     const envelope = {
       panelId: args.panel.id,
       state: "ok",
-      observedAt: observedAt2(upstream.headers.get("date")),
+      observedAt: signal.testResults ? oldestObservation(selected.observedAt, signal.testResults.observedAt) : selected.observedAt,
       link: run.html_url,
       signal
     };
-    return { envelope, response: upstream };
+    return { envelope, response: parsedPanel.test_results ? new Response(null) : upstream };
   } catch (error) {
     return {
       response: new Response(

package/dist/lambda.mjs

@@ -71277,11 +71277,11 @@ var panelSchema = external_exports.looseObject({
         path: ["test_results"],
         message: "test-count requires test_results artifact configuration"
       });
-  } else if (panel.test_results) {
+  } else if (panel.test_results && panel.type !== "pipeline-status") {
     ctx.addIssue({
       code: "custom",
       path: ["test_results"],
-      message: "test_results is only supported by test-count panels"
+      message: "test_results is only supported by test-count and pipeline-status panels"
     });
   }
   if (panel.type !== "http-value") return;
@@ -71531,6 +71531,12 @@ var boardConfigSchema = external_exports.object({
           }
         });
       }
+      if (panel.type === "pipeline-status" && panel.test_results && source?.type !== "github-actions")
+        ctx.addIssue({
+          code: "custom",
+          path: ["boards", boardName, "panels", panelIndex, "test_results"],
+          message: "test_results requires a github-actions source"
+        });
       if (panel.type !== "pipeline-status" || source?.type !== "azure-devops") return;
       if (typeof panel.pipeline !== "number" || !Number.isInteger(panel.pipeline) || panel.pipeline <= 0) {
         ctx.addIssue({
@@ -71643,11 +71649,29 @@ var pipelineActivitySchema = external_exports.object({
   name: external_exports.string().min(1),
   parent: external_exports.string().min(1).optional()
 });
+var testCountSchema = external_exports.discriminatedUnion("status", [
+  external_exports.object({
+    type: external_exports.literal("test-count"),
+    status: external_exports.literal("reported"),
+    total: external_exports.number().int().nonnegative(),
+    passed: external_exports.number().int().nonnegative().optional(),
+    failed: external_exports.number().int().nonnegative().optional(),
+    skipped: external_exports.number().int().nonnegative().optional()
+  }),
+  external_exports.object({ type: external_exports.literal("test-count"), status: external_exports.literal("pending") }),
+  external_exports.object({ type: external_exports.literal("test-count"), status: external_exports.literal("not-reported") })
+]);
+var testEvidenceSchema = external_exports.discriminatedUnion("state", [
+  external_exports.object({ state: external_exports.literal("ok"), observedAt: external_exports.iso.datetime(), signal: testCountSchema }),
+  external_exports.object({ state: external_exports.literal("error"), observedAt: external_exports.iso.datetime(), error: envelopeErrorSchema })
+]);
 var pipelineStatusSchema = external_exports.object({
   type: external_exports.literal("pipeline-status"),
   status: external_exports.enum(["passed", "failed", "warning", "running", "cancelled", "unknown"]),
   /** The source's unmodified status/result vocabulary, for an honest display. */
   rawStatus: external_exports.string(),
+  /** Test evidence bound to this exact run; failures do not erase build status. */
+  testResults: testEvidenceSchema.optional(),
   name: external_exports.string().min(1),
   /** The branch represented by this status, when the upstream supplies or filters by one. */
   branch: external_exports.string().min(1).optional(),
@@ -71664,18 +71688,6 @@ var pipelineStatusSchema = external_exports.object({
   /** When this workflow run was last updated by its source, distinct from our observation time. */
   sourceUpdatedAt: external_exports.iso.datetime().optional()
 });
-var testCountSchema = external_exports.discriminatedUnion("status", [
-  external_exports.object({
-    type: external_exports.literal("test-count"),
-    status: external_exports.literal("reported"),
-    total: external_exports.number().int().nonnegative(),
-    passed: external_exports.number().int().nonnegative().optional(),
-    failed: external_exports.number().int().nonnegative().optional(),
-    skipped: external_exports.number().int().nonnegative().optional()
-  }),
-  external_exports.object({ type: external_exports.literal("test-count"), status: external_exports.literal("pending") }),
-  external_exports.object({ type: external_exports.literal("test-count"), status: external_exports.literal("not-reported") })
-]);
 var pullRequestHealthItemSchema = external_exports.object({
   label: external_exports.string().min(1),
   status: pipelineStatusSchema.shape.status,
@@ -72754,6 +72766,7 @@ function concat(chunks, length) {
 
 // packages/server/src/adapters/github-actions.ts
 var pipelinePanelSchema = external_exports.object({
+  test_results: testResultsArtifactSchema.optional(),
   id: external_exports.string().min(1),
   type: external_exports.literal("pipeline-status"),
   source: external_exports.string().min(1),
@@ -72829,37 +72842,60 @@ function testCountCapabilities(panel, source) {
 async function fetchGithubActionsTestCount(args) {
   const { panel, source } = testCountCapabilities(args.panel, args.source);
   const githubClient = githubClientFor(args);
-  const noValidators = new Headers();
-  let failureLink = sourceLinkForWorkflow(source, panel.pipeline);
-  let failureObservedAt;
   try {
     const selected = await selectGithubWorkflowRun({
       ...args,
       source,
       workflow: panel.pipeline,
-      requestHeaders: noValidators,
+      requestHeaders: new Headers(),
       githubClient
     });
     if (!selected.response.ok) return testCountFailure(panel.id, source, selected.response);
-    const { run } = selected;
-    if (!run?.id)
+    if (!selected.run?.id)
       return testCountEnvelope(
         noRunEnvelope(panel.id, source, panel.pipeline, selected.response.headers.get("date"))
       );
-    const link = run.html_url;
-    const runObservedAt = selected.observedAt;
-    failureLink = link;
-    failureObservedAt = runObservedAt;
+    const evidence = await readGithubRunTestEvidence(
+      { ...args, source, githubClient },
+      {
+        run: selected.run,
+        observedAt: selected.observedAt
+      },
+      panel.test_results
+    );
+    return testCountEnvelope({ ...evidence, panelId: panel.id, link: selected.run.html_url });
+  } catch (error63) {
+    return testCountEnvelope(
+      errorEnvelope(
+        panel.id,
+        error63 instanceof GithubAuthenticationError ? "unauthorized" : "upstream-error",
+        error63,
+        sourceLinkForWorkflow(source, panel.pipeline)
+      )
+    );
+  }
+}
+async function readGithubRunTestEvidence(args, selected, artifactConfig) {
+  const { run, observedAt: runObservedAt } = selected;
+  const { source, githubClient } = args;
+  const noValidators = new Headers();
+  let failureObservedAt = runObservedAt;
+  const evidenceError = (kind, at = failureObservedAt) => ({
+    state: "error",
+    observedAt: at,
+    error: { kind, message: publicErrorMessage(kind) }
+  });
+  const failedResponse = (response) => evidenceError(errorKind(response.status), observedAt2(response.headers.get("date")));
+  try {
+    if (!run.id) return evidenceError("upstream-error");
     if (run.status !== "completed")
-      return testCountEnvelope({
-        panelId: panel.id,
+      return {
         state: "ok",
         observedAt: runObservedAt,
-        link,
         signal: { type: "test-count", status: "pending" }
-      });
+      };
     const artifactsResponse = await githubFetch(
-      githubArtifactsCall(source, run.id, panel.test_results),
+      githubArtifactsCall(source, run.id, artifactConfig),
       {
         ...args,
         source,
@@ -72867,57 +72903,37 @@ async function fetchGithubActionsTestCount(args) {
         githubClient
       }
     );
-    if (!artifactsResponse.ok) return testCountFailure(panel.id, source, artifactsResponse, link);
+    if (!artifactsResponse.ok) return failedResponse(artifactsResponse);
     const artifactObservedAt = observedAt2(artifactsResponse.headers.get("date"));
     failureObservedAt = oldestObservation(runObservedAt, artifactObservedAt);
     const artifacts = artifactsSchema.parse(await artifactsResponse.json()).artifacts;
-    const matches = artifacts.filter((artifact2) => artifact2.name === panel.test_results.artifact);
+    const matches = artifacts.filter((artifact2) => artifact2.name === artifactConfig.artifact);
     if (matches.length === 0)
-      return testCountEnvelope({
-        panelId: panel.id,
+      return {
         state: "ok",
         observedAt: oldestObservation(runObservedAt, artifactObservedAt),
-        link,
         signal: { type: "test-count", status: "not-reported" }
-      });
-    if (matches.length !== 1 || matches[0]?.expired)
-      return testCountEnvelope(
-        errorEnvelope(
-          panel.id,
-          "upstream-error",
-          "The test-results artifact is unavailable.",
-          link
-        )
-      );
+      };
     const [artifact] = matches;
-    if (!artifact)
-      return testCountEnvelope(
-        errorEnvelope(
-          panel.id,
-          "upstream-error",
-          "The test-results artifact is unavailable.",
-          link
-        )
-      );
+    if (matches.length !== 1 || !artifact || artifact.expired)
+      return evidenceError("upstream-error");
     const archiveResponse = await githubFetch(githubArtifactDownloadCall(source, artifact.id), {
       ...args,
       source,
       requestHeaders: noValidators,
       githubClient
     });
-    if (!archiveResponse.ok) return testCountFailure(panel.id, source, archiveResponse, link);
+    if (!archiveResponse.ok) return failedResponse(archiveResponse);
     const archiveObservedAt = observedAt2(archiveResponse.headers.get("date"));
     failureObservedAt = oldestObservation(runObservedAt, artifactObservedAt, archiveObservedAt);
     const summary = testResultsSummarySchema.parse(
-      JSON.parse(await readTestResultsArtifact(archiveResponse, panel.test_results.entry))
+      JSON.parse(await readTestResultsArtifact(archiveResponse, artifactConfig.entry))
     );
     if (summary.runId !== run.id || summary.runAttempt !== run.run_attempt || summary.headSha !== run.head_sha)
       throw new Error("Test-results manifest does not belong to the selected workflow run.");
-    return testCountEnvelope({
-      panelId: panel.id,
+    return {
       state: "ok",
       observedAt: oldestObservation(runObservedAt, artifactObservedAt, archiveObservedAt),
-      link,
       signal: {
         type: "test-count",
         status: "reported",
@@ -72926,16 +72942,10 @@ async function fetchGithubActionsTestCount(args) {
         ...summary.failed === void 0 ? {} : { failed: summary.failed },
         ...summary.skipped === void 0 ? {} : { skipped: summary.skipped }
       }
-    });
+    };
   } catch (error63) {
-    return testCountEnvelope(
-      errorEnvelope(
-        panel.id,
-        error63 instanceof GithubAuthenticationError ? "unauthorized" : "upstream-error",
-        error63,
-        failureLink,
-        failureObservedAt
-      )
+    return evidenceError(
+      error63 instanceof GithubAuthenticationError ? "unauthorized" : "upstream-error"
     );
   }
 }
@@ -73151,6 +73161,7 @@ async function fetchGithubActionsPipeline(args) {
       ...args,
       source: parsedSource,
       workflow: parsedPanel.pipeline,
+      requestHeaders: parsedPanel.test_results ? new Headers() : args.requestHeaders,
       githubClient
     });
   } catch (error63) {
@@ -73215,14 +73226,21 @@ async function fetchGithubActionsPipeline(args) {
       });
       if (activity) signal.activity = activity;
     }
+    if (parsedPanel.test_results) {
+      signal.testResults = await readGithubRunTestEvidence(
+        { ...args, source: parsedSource, githubClient },
+        { run, observedAt: selected.observedAt },
+        parsedPanel.test_results
+      );
+    }
     const envelope = {
       panelId: args.panel.id,
       state: "ok",
-      observedAt: observedAt2(upstream.headers.get("date")),
+      observedAt: signal.testResults ? oldestObservation(selected.observedAt, signal.testResults.observedAt) : selected.observedAt,
       link: run.html_url,
       signal
     };
-    return { envelope, response: upstream };
+    return { envelope, response: parsedPanel.test_results ? new Response(null) : upstream };
   } catch (error63) {
     return {
       response: new Response(
@@ -76541,7 +76559,8 @@ function validateClaimsSet(protectedHeader, claimsSetBytes, options = {}) {
       throw new TypeError("Invalid clockTolerance option type");
     tolerance = clockTolerance;
   }
-  validateInput("clockTolerance option", tolerance);
+  if (validateInput("clockTolerance option", tolerance), tolerance < 0)
+    throw new TypeError("Invalid clockTolerance option input");
   const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(claimsSet, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(claimsSet, "nbf");
   if (nbf !== void 0 && nbf > now + tolerance)
     throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', claimsSet, "nbf", checkFailed);
@@ -76627,7 +76646,7 @@ function isCloudflareWorkers() {
   return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 var USER_AGENT2;
-(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT2 = "jose/v6.2.14");
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT2 = "jose/v6.2.15");
 var customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url2, headers, signal, fetchImpl = fetch) {
   const response = await fetchImpl(url2, {
@@ -76653,6 +76672,8 @@ function isFreshFor(timestamp4, duration3) {
 function validateDuration(value, fallback2, option) {
   if (Number.isNaN(value))
     throw new TypeError(`"${option}" option must not be NaN`);
+  if (typeof value == "number" && value < 0)
+    throw new TypeError(`"${option}" option must not be negative`);
   return typeof value == "number" ? value : fallback2;
 }
 function createRemoteJWKSet(url2, options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@continuous-excellence/ze-great-dashboard-aws",
-  "version": "0.31.54",
+  "version": "0.31.56",
   "type": "module",
   "description": "AWS server runtime and CloudFormation deployment tooling for Ze Great Dashboard.",
   "keywords": [