@decohere/ci-tools 0.0.1-dev.109 → 0.0.1-dev.11

package/tests/audit/format.test.mjs

@@ -1,115 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-	formatLog,
-	formatMarkdown,
-	highCritical,
-	parseAudit,
-} from "../../src/audit/format.mjs";
-
-const fixture = {
-	metadata: {
-		vulnerabilities: { info: 0, low: 1, moderate: 0, high: 1, critical: 0, total: 2 },
-	},
-	advisories: {
-		1: {
-			id: 1,
-			module_name: "nanoid",
-			severity: "high",
-			title: "nanoid: custom generators can loop indefinitely when size is zero",
-			url: "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
-			vulnerable_versions: "<3.3.18",
-			patched_versions: ">=3.3.18",
-			cves: [],
-			findings: [{ version: "3.3.17", paths: [". > vite > postcss > nanoid@3.3.17"] }],
-		},
-		2: {
-			id: 2,
-			module_name: "esbuild",
-			severity: "low",
-			title: "esbuild Windows file read",
-			url: "https://github.com/advisories/GHSA-g7r4-m6w7-qqqr",
-			vulnerable_versions: "<0.28.1",
-			patched_versions: ">=0.28.1",
-			cves: [],
-			findings: [{ version: "0.27.3", paths: [". > vite > esbuild"] }],
-		},
-	},
-};
-
-describe("parseAudit", () => {
-	it("reads severity counts and sorts advisories critical/high first", () => {
-		const parsed = parseAudit(fixture);
-		expect(parsed.total).toBe(2);
-		expect(parsed.high).toBe(1);
-		expect(parsed.low).toBe(1);
-		expect(parsed.advisories.map((a) => a.module)).toEqual(["nanoid", "esbuild"]);
-		expect(parsed.advisories[0]?.severity).toBe("high");
-		expect(parsed.advisories[0]?.ghsa).toBe("GHSA-2v37-7h3g-55p8");
-	});
-});
-
-describe("formatLog", () => {
-	it("prints severity counts and advisory lines including GHSA", () => {
-		const log = formatLog(parseAudit(fixture));
-		expect(log).toContain("high=1");
-		expect(log).toContain("[high] nanoid GHSA-2v37-7h3g-55p8");
-		expect(log).toContain("[low] esbuild");
-	});
-});
-
-describe("formatMarkdown", () => {
-	it("includes a severity table and linked advisories", () => {
-		const md = formatMarkdown(parseAudit(fixture));
-		expect(md).toContain("| High | 1 |");
-		expect(md).toContain("**high** `nanoid`");
-		expect(md).toContain("GHSA-2v37-7h3g-55p8");
-	});
-});
-
-describe("highCritical", () => {
-	it("filters to high and critical only", () => {
-		expect(highCritical(parseAudit(fixture)).map((a) => a.module)).toEqual(["nanoid"]);
-	});
-});
-
-describe("parseAudit npm v2", () => {
-	it("dedupes GHSA rows from package via objects", () => {
-		const v2 = {
-			auditReportVersion: 2,
-			metadata: {
-				vulnerabilities: { info: 0, low: 0, moderate: 0, high: 1, critical: 0, total: 1 },
-			},
-			vulnerabilities: {
-				nanoid: {
-					name: "nanoid",
-					severity: "high",
-					via: [
-						{
-							source: 1103848,
-							name: "nanoid",
-							title: "nanoid infinite loop",
-							url: "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
-							severity: "high",
-							range: "<3.3.18",
-						},
-					],
-					range: "<3.3.18",
-					nodes: ["node_modules/.pnpm/nanoid@3.3.17/node_modules/nanoid"],
-				},
-				postcss: {
-					name: "postcss",
-					severity: "high",
-					via: ["nanoid"],
-					effects: [],
-					range: "*",
-					nodes: ["node_modules/.pnpm/postcss@8.5.26/node_modules/postcss"],
-				},
-			},
-		};
-		const parsed = parseAudit(v2);
-		expect(parsed.advisories).toHaveLength(1);
-		expect(parsed.advisories[0]?.module).toBe("nanoid");
-		expect(parsed.advisories[0]?.ghsa).toBe("GHSA-2v37-7h3g-55p8");
-		expect(parsed.advisories[0]?.vulnerable).toBe("<3.3.18");
-	});
-});

package/tests/github/credential-nudge.test.mjs

@@ -1,65 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-	assessTokenLifetime,
-	buildDescription,
-	CREDENTIALS,
-	credentialProfile,
-	ghScopeFlags,
-	parseExpiresAt,
-	rotationCommands,
-	suggestedNextExpiry,
-	taskName,
-} from "../../src/github/credential-nudge.mjs";
-
-describe("credential-nudge", () => {
-	it("parses YYYY-MM-DD as a UTC day", () => {
-		expect(parseExpiresAt("2026-11-19")).toBe(Date.UTC(2026, 10, 19));
-		expect(parseExpiresAt("")).toBeNull();
-	});
-
-	it("is ok more than 14 days out, warns inside the window, expires on the day", () => {
-		const expiresAtMs = Date.UTC(2026, 10, 19);
-		const now = (day) => Date.UTC(2026, 10, day, 15);
-		expect(assessTokenLifetime({ now: now(1), expiresAtMs }).kind).toBe("ok");
-		expect(assessTokenLifetime({ now: now(5), expiresAtMs })).toEqual({
-			kind: "warn",
-			daysLeft: 14,
-		});
-		expect(assessTokenLifetime({ now: now(18), expiresAtMs }).kind).toBe("warn");
-		expect(assessTokenLifetime({ now: now(19), expiresAtMs })).toEqual({
-			kind: "expired",
-			daysLeft: 0,
-		});
-		expect(assessTokenLifetime({ now: now(20), expiresAtMs }).kind).toBe("expired");
-		expect(assessTokenLifetime({ expiresAtMs: null }).kind).toBe("missing");
-	});
-
-	it("parameterizes GHCR vs npm rotate commands without duplicating date logic", () => {
-		const ghcr = credentialProfile("ghcr");
-		const npm = credentialProfile("npm");
-		expect(ghScopeFlags(ghcr)).toBe("--env ghcr-publish ");
-		expect(ghScopeFlags(npm)).toBe("");
-		expect(rotationCommands(ghcr, "2027-02-17", "typesmiths/decohere")).toContain(
-			"gh secret set GHCR_PUSH_TOKEN --env ghcr-publish --repo typesmiths/decohere",
-		);
-		expect(rotationCommands(npm, "2027-02-17", "typesmiths/decohere")).toContain(
-			"gh secret set NODE_AUTH_TOKEN --repo typesmiths/decohere",
-		);
-		expect(rotationCommands(npm, "2027-02-17", "typesmiths/decohere")).toContain(
-			"gh variable set NODE_AUTH_TOKEN_EXPIRES_AT --repo typesmiths/decohere --body 2027-02-17",
-		);
-		expect(taskName(npm, "2026-11-19")).toBe(
-			"chore(security): rotate NODE_AUTH_TOKEN (expires 2026-11-19)",
-		);
-		const body = buildDescription(ghcr, {
-			kind: "warn",
-			expiresYmd: "2026-11-19",
-			daysLeft: 14,
-			rejected: false,
-		});
-		expect(body).toContain("Docker login/push and the `v*` tag will **fail**");
-		expect(CREDENTIALS.npm.secret).toBe("NODE_AUTH_TOKEN");
-		expect(suggestedNextExpiry(Date.UTC(2026, 7, 21), 90)).toBe("2026-11-19");
-		expect(() => credentialProfile("nope")).toThrow(/Unknown NUDGE_CREDENTIAL/);
-	});
-});

package/tests/github/oidc-bootstrap-nudge.test.mjs

@@ -1,104 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-	bootstrapTaskNames,
-	buildDescription,
-	extractGitHubReviewerLogins,
-	firstPublishCommands,
-	mapLoginsToClickUpIds,
-	needsPrereleaseTag,
-	parseAssigneeIds,
-	parseUnpublished,
-	runNudge,
-	taskName,
-} from "../../src/github/oidc-bootstrap-nudge.mjs";
-
-describe("oidc-bootstrap-nudge", () => {
-	it("parses unpublished names and assignee ids", () => {
-		expect(parseUnpublished(" @decohere/scaffold  @decohere/cli ")).toEqual([
-			"@decohere/scaffold",
-			"@decohere/cli",
-		]);
-		expect(parseAssigneeIds("308432336, 99")).toEqual([308432336, 99]);
-		expect(parseAssigneeIds("")).toEqual([]);
-		expect(taskName()).toBe("deploy(publish): OIDC bootstrap unpublished packages");
-		expect(bootstrapTaskNames()).toContain(
-			"chore(publish): OIDC bootstrap unpublished packages",
-		);
-	});
-
-	it("extracts GitHub user reviewers and maps login to ClickUp email local-part", () => {
-		expect(
-			extractGitHubReviewerLogins({
-				protection_rules: [
-					{ type: "branch_policy", reviewers: [] },
-					{
-						type: "required_reviewers",
-						reviewers: [
-							{ type: "User", reviewer: { login: "das974" } },
-							{ type: "Team", reviewer: { slug: "publishers", login: "should-skip" } },
-						],
-					},
-				],
-			}),
-		).toEqual(["das974"]);
-		expect(
-			mapLoginsToClickUpIds(
-				["das974"],
-				[{ id: 308432336, username: "Daniel Scalamogna", email: "das974@gmail.com" }],
-			),
-		).toEqual([308432336]);
-		expect(mapLoginsToClickUpIds(["other"], [{ id: 1, email: "das974@gmail.com" }])).toEqual(
-			[],
-		);
-	});
-
-	it("puts first-publish commands and Trusted Publisher fields in the task body", () => {
-		const pkg = { name: "@decohere/scaffold", dir: "scaffold", version: "0.0.1-dev.18" };
-		const body = buildDescription({
-			unpublished: ["@decohere/scaffold"],
-			packages: [pkg],
-			repo: "typesmiths/decohere",
-			runUrl: "https://github.com/typesmiths/decohere/actions/runs/9",
-			channel: "dev",
-		});
-		expect(needsPrereleaseTag("0.0.1-dev.18")).toBe(true);
-		expect(needsPrereleaseTag("1.2.3")).toBe(false);
-		expect(firstPublishCommands([pkg], "dev")).toEqual([
-			"npm publish ./projects/scaffold --tag dev",
-		]);
-		expect(firstPublishCommands([{ ...pkg, version: "1.0.0" }], "dev")).toEqual([
-			"npm publish ./projects/scaffold",
-		]);
-		expect(body).toContain("npm publish ./projects/scaffold --tag dev");
-		expect(body).not.toMatch(/# @decohere\/scaffold/);
-		expect(body).toContain("do **not** pass `--access public`");
-		expect(firstPublishCommands([pkg], "dev").join("\n")).not.toContain("--access public");
-		expect(body).toContain("Workflow filename: `publish.yml`");
-		expect(body).toContain("Environment: `npm-publish`");
-		expect(body).toContain("gh run rerun --failed");
-		expect(body).toContain("https://github.com/typesmiths/decohere/actions/runs/9");
-	});
-
-	it("assigns mapped GitHub reviewers when upserting the ClickUp task", async () => {
-		/** @type {object[]} */
-		const upserts = [];
-		const code = await runNudge(
-			{ UNPUBLISHED: "@decohere/scaffold", GITHUB_REPOSITORY: "typesmiths/decohere" },
-			{
-				listPackages: () => [{ name: "@decohere/scaffold", dir: "scaffold" }],
-				githubReviewers: async () => ["das974"],
-				clickupMembers: async () => [
-					{ id: 308432336, username: "Daniel Scalamogna", email: "das974@gmail.com" },
-				],
-				upsert: async (options) => {
-					upserts.push(options);
-					return { id: "abc", url: "https://app.clickup.com/t/abc", created: true };
-				},
-				runUrl: "https://github.com/typesmiths/decohere/actions/runs/1",
-			},
-		);
-		expect(code).toBe(0);
-		expect(upserts[0].assigneeIds).toEqual([308432336]);
-		expect(upserts[0].unpublished).toEqual(["@decohere/scaffold"]);
-	});
-});

package/tests/github/publish-verify.test.mjs

@@ -1,95 +0,0 @@
-import { vol } from "memfs";
-import { afterEach, describe, expect, it } from "vitest";
-import {
-	collectPublishVerify,
-	formatGithubOutput,
-	listPublishablePackages,
-	parseGhcrRepository,
-} from "../../src/github/publish-verify.mjs";
-
-function seedWorkspace() {
-	const root = "/workspace";
-	vol.fromJSON({
-		[`${root}/package.json`]: JSON.stringify({ version: "0.0.1-dev.79" }),
-		[`${root}/projects/cli/package.json`]: JSON.stringify({
-			name: "@decohere/cli",
-			version: "0.0.1-dev.79",
-		}),
-		[`${root}/projects/scaffold/package.json`]: JSON.stringify({
-			name: "@decohere/scaffold",
-			version: "0.0.1-dev.79",
-			private: true,
-		}),
-		[`${root}/projects/create/package.json`]: JSON.stringify({
-			name: "@decohere/create",
-			version: "0.0.1-dev.79",
-			decohere: { dockerImageRepository: "ghcr.io/typesmiths/decohere/create" },
-		}),
-		[`${root}/projects/devcontainer/package.json`]: JSON.stringify({
-			name: "@decohere/devcontainer",
-			private: true,
-			decohere: { dockerImageRepository: "ghcr.io/typesmiths/decohere/devcontainer" },
-		}),
-	});
-	return root;
-}
-
-afterEach(() => {
-	vol.reset();
-});
-
-describe("publish-verify", () => {
-	it("lists non-private workspace packages", () => {
-		const root = seedWorkspace();
-		expect(listPublishablePackages(root).map((pkg) => pkg.name)).toEqual([
-			"@decohere/cli",
-			"@decohere/create",
-		]);
-	});
-
-	it("parses GHCR repository coordinates", () => {
-		expect(parseGhcrRepository("ghcr.io/typesmiths/decohere/create")).toEqual({
-			org: "typesmiths",
-			packageName: "decohere/create",
-		});
-	});
-
-	it("marks names missing from npm as unpublished and skip_npm when every version exists", async () => {
-		const root = seedWorkspace();
-		const views = [];
-		const spawnSync = (_cmd, args) => {
-			views.push(args[1]);
-			if (args[1] === "@decohere/cli") {
-				return { status: 1 };
-			}
-			return { status: 0 };
-		};
-		const result = await collectPublishVerify({
-			root,
-			spawnSync,
-			githubToken: "",
-		});
-		expect(result.unpublished).toEqual(["@decohere/cli"]);
-		expect(result.skipNpm).toBe(false);
-		expect(views).toContain("@decohere/cli");
-		expect(views).toContain("@decohere/create");
-		expect(views).toContain("@decohere/create@0.0.1-dev.79");
-	});
-
-	it("sets skip_docker when both GHCR tags exist", async () => {
-		const root = seedWorkspace();
-		const fetch = async () => ({
-			ok: true,
-			status: 200,
-			json: async () => [{ metadata: { container: { tags: ["0.0.1-dev.79"] } } }],
-		});
-		const result = await collectPublishVerify({
-			root,
-			spawnSync: () => ({ status: 0 }),
-			githubToken: "ghs_test",
-			fetch,
-		});
-		expect(result.skipDocker).toBe(true);
-		expect(formatGithubOutput(result)).toContain("skip_docker=true");
-	});
-});

package/tests/github/smoke-create-launcher.test.mjs

@@ -1,71 +0,0 @@
-import { fileURLToPath } from "node:url";
-import { describe, expect, it, vi } from "vitest";
-import { runCreateLauncherSmoke } from "../../src/github/smoke-create-launcher.mjs";
-
-const fs = await vi.importActual("node:fs");
-const PUBLISH_YML = fileURLToPath(
-	new URL("../../../../.github/workflows/publish.yml", import.meta.url),
-);
-
-describe("runCreateLauncherSmoke", () => {
-	it("execs npx from a temp directory, not the repo root", () => {
-		/** @type {{ cmd: string, args: string[], opts: { cwd?: string } }[]} */
-		const calls = [];
-		const written = [];
-
-		const result = runCreateLauncherSmoke({
-			createVersion: "0.0.1-dev.80",
-			authToken: "tok",
-			tmpdir: () => "/tmp",
-			mkdtempSync: (prefix) => `${prefix}abc`,
-			writeFileSync: (path, body) => {
-				written.push({ path, body });
-			},
-			spawnSync: (cmd, args, opts) => {
-				calls.push({ cmd, args, opts });
-				return { status: 0 };
-			},
-			stdio: "pipe",
-		});
-
-		expect(result.workDir).toBe("/tmp/decohere-create-smoke-abc");
-		expect(result.workDir).not.toBe(process.cwd());
-		expect(calls).toHaveLength(1);
-		expect(calls[0].cmd).toBe("npx");
-		expect(calls[0].args).toEqual(["--yes", "@decohere/create@0.0.1-dev.80", "--help"]);
-		expect(calls[0].opts.cwd).toBe("/tmp/decohere-create-smoke-abc");
-		expect(calls[0].opts.cwd).not.toBe(process.cwd());
-		expect(written).toEqual([
-			{
-				path: "/tmp/decohere-create-smoke-abc/.npmrc",
-				body: "@decohere:registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=tok\n",
-			},
-		]);
-	});
-
-	it("fails closed without version or token", () => {
-		expect(() => runCreateLauncherSmoke({ createVersion: "", authToken: "tok" })).toThrow(
-			"CREATE_VERSION is required",
-		);
-		expect(() =>
-			runCreateLauncherSmoke({ createVersion: "0.0.1-dev.80", authToken: "" }),
-		).toThrow("NODE_AUTH_TOKEN is required");
-	});
-});
-
-describe("publish.yml create smoke + tag", () => {
-	const yml = fs.readFileSync(PUBLISH_YML, "utf8");
-
-	it("wires create smoke through the isolated launcher", () => {
-		expect(yml).toContain("node projects/ci-tools/src/github/smoke-create-launcher.mjs");
-		expect(yml).toContain("CREATE_VERSION:");
-		expect(yml).not.toContain("npx --yes");
-	});
-
-	it("grants the tag job actions:read so publish-prepare can download CI artifacts", () => {
-		const tag = yml.slice(yml.indexOf("\n  tag:"));
-		const perms = tag.slice(tag.indexOf("permissions:"), tag.indexOf("steps:"));
-		expect(perms).toMatch(/contents:\s*write/);
-		expect(perms).toMatch(/actions:\s*read/);
-	});
-});