@decohere/ci-tools 0.0.1-dev.11 → 0.0.1-dev.110

package/src/release/sync-dependencies.mjs

@@ -7,10 +7,9 @@
 import { execSync } from "node:child_process";
 
 const DRY_RUN = process.env.DRY_RUN === "true";
-const TERMINAL_CLI = process.env.TERMINAL_CLI || "dist/debug/projects/terminal/src/cli.js";
 const DECOHERE_CONFIG = process.env.DECOHERE_CONFIG || ".decohere.js";
 
-const baseCmd = `node "${TERMINAL_CLI}" --log-level trace --config-file "${DECOHERE_CONFIG}" forge dependencies --configuration release sync`;
+const baseCmd = `pnpm forge --log-level info --config-file "${DECOHERE_CONFIG}" dependencies --configuration release sync`;
 
 try {
 	if (DRY_RUN) {

package/tests/audit/format.test.mjs

@@ -0,0 +1,115 @@
+import { describe, expect, it } from "vitest";
+import {
+	formatLog,
+	formatMarkdown,
+	highCritical,
+	parseAudit,
+} from "../../src/audit/format.mjs";
+
+const fixture = {
+	metadata: {
+		vulnerabilities: { info: 0, low: 1, moderate: 0, high: 1, critical: 0, total: 2 },
+	},
+	advisories: {
+		1: {
+			id: 1,
+			module_name: "nanoid",
+			severity: "high",
+			title: "nanoid: custom generators can loop indefinitely when size is zero",
+			url: "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
+			vulnerable_versions: "<3.3.18",
+			patched_versions: ">=3.3.18",
+			cves: [],
+			findings: [{ version: "3.3.17", paths: [". > vite > postcss > nanoid@3.3.17"] }],
+		},
+		2: {
+			id: 2,
+			module_name: "esbuild",
+			severity: "low",
+			title: "esbuild Windows file read",
+			url: "https://github.com/advisories/GHSA-g7r4-m6w7-qqqr",
+			vulnerable_versions: "<0.28.1",
+			patched_versions: ">=0.28.1",
+			cves: [],
+			findings: [{ version: "0.27.3", paths: [". > vite > esbuild"] }],
+		},
+	},
+};
+
+describe("parseAudit", () => {
+	it("reads severity counts and sorts advisories critical/high first", () => {
+		const parsed = parseAudit(fixture);
+		expect(parsed.total).toBe(2);
+		expect(parsed.high).toBe(1);
+		expect(parsed.low).toBe(1);
+		expect(parsed.advisories.map((a) => a.module)).toEqual(["nanoid", "esbuild"]);
+		expect(parsed.advisories[0]?.severity).toBe("high");
+		expect(parsed.advisories[0]?.ghsa).toBe("GHSA-2v37-7h3g-55p8");
+	});
+});
+
+describe("formatLog", () => {
+	it("prints severity counts and advisory lines including GHSA", () => {
+		const log = formatLog(parseAudit(fixture));
+		expect(log).toContain("high=1");
+		expect(log).toContain("[high] nanoid GHSA-2v37-7h3g-55p8");
+		expect(log).toContain("[low] esbuild");
+	});
+});
+
+describe("formatMarkdown", () => {
+	it("includes a severity table and linked advisories", () => {
+		const md = formatMarkdown(parseAudit(fixture));
+		expect(md).toContain("| High | 1 |");
+		expect(md).toContain("**high** `nanoid`");
+		expect(md).toContain("GHSA-2v37-7h3g-55p8");
+	});
+});
+
+describe("highCritical", () => {
+	it("filters to high and critical only", () => {
+		expect(highCritical(parseAudit(fixture)).map((a) => a.module)).toEqual(["nanoid"]);
+	});
+});
+
+describe("parseAudit npm v2", () => {
+	it("dedupes GHSA rows from package via objects", () => {
+		const v2 = {
+			auditReportVersion: 2,
+			metadata: {
+				vulnerabilities: { info: 0, low: 0, moderate: 0, high: 1, critical: 0, total: 1 },
+			},
+			vulnerabilities: {
+				nanoid: {
+					name: "nanoid",
+					severity: "high",
+					via: [
+						{
+							source: 1103848,
+							name: "nanoid",
+							title: "nanoid infinite loop",
+							url: "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
+							severity: "high",
+							range: "<3.3.18",
+						},
+					],
+					range: "<3.3.18",
+					nodes: ["node_modules/.pnpm/nanoid@3.3.17/node_modules/nanoid"],
+				},
+				postcss: {
+					name: "postcss",
+					severity: "high",
+					via: ["nanoid"],
+					effects: [],
+					range: "*",
+					nodes: ["node_modules/.pnpm/postcss@8.5.26/node_modules/postcss"],
+				},
+			},
+		};
+		const parsed = parseAudit(v2);
+		expect(parsed.advisories).toHaveLength(1);
+		expect(parsed.advisories[0]?.module).toBe("nanoid");
+		expect(parsed.advisories[0]?.ghsa).toBe("GHSA-2v37-7h3g-55p8");
+		expect(parsed.advisories[0]?.vulnerable).toBe("<3.3.18");
+	});
+});

package/tests/bench/history.test.mjs

@@ -0,0 +1,251 @@
+import { describe, expect, it } from "vitest";
+import {
+	appendRun,
+	assertValid,
+	compare,
+	contextId,
+	findRegressions,
+	formatComparison,
+	fromVitest,
+	getContext,
+	normalize,
+	parseResults,
+	previousRun,
+	RESULT_PREFIX,
+} from "../../src/bench/history.mjs";
+
+const fakeOs = {
+	cpus: () => [{ model: " Test CPU " }, { model: "Test CPU" }],
+	platform: () => "linux",
+	arch: () => "x64",
+	totalmem: () => 16 * 1024 ** 3,
+};
+const ctx = getContext(
+	fakeOs,
+	{ BENCH_ENV: "gh-actions" },
+	"v24.1.0",
+	new Date("2026-10-20T03:17:00Z"),
+);
+
+const result = (id, median, extra = {}) => ({
+	id,
+	label: id,
+	unit: "ms",
+	median,
+	p90: median * 1.2,
+	min: median * 0.9,
+	max: median * 1.3,
+	samples: 5,
+	...extra,
+});
+
+const vitestOutput = {
+	files: [
+		{
+			groups: [
+				{
+					benchmarks: [
+						{
+							name: "forge build es6 + types (18 files)",
+							mean: 70,
+							median: 64,
+							min: 60,
+							max: 80,
+							sampleCount: 5,
+						},
+						{
+							name: "forge build es6 only (18 files)",
+							mean: 10,
+							min: 8,
+							max: 12,
+							sampleCount: 5,
+						},
+					],
+				},
+			],
+		},
+	],
+};
+
+describe("getContext / contextId", () => {
+	it("describes the machine and names the CI environment with the Node major", () => {
+		expect(ctx).toEqual({
+			benchEnv: "gh-actions-node24",
+			date: "2026-10-20T03:17:00.000Z",
+			os: { platform: "linux", arch: "x64" },
+			cpu: { model: "Test CPU", count: 2 },
+			memoryGb: 16,
+			node: "v24.1.0",
+		});
+		expect(getContext(fakeOs, {}, "v24.1.0").benchEnv).toBe("(local)");
+	});
+
+	it("gives the same id to the same machine regardless of date or env label", () => {
+		const later = getContext(fakeOs, {}, "v24.1.0", new Date("2027-01-01"));
+		expect(contextId(later)).toBe(contextId(ctx));
+		expect(contextId({ ...ctx, cpu: { ...ctx.cpu, count: 4 } })).not.toBe(contextId(ctx));
+	});
+});
+
+describe("parseResults", () => {
+	it("reads the last result line among other output", () => {
+		const results = [result("flux.load.cold", 250)];
+		const output = `flux load: median 250 ms\n${RESULT_PREFIX}[]\n${RESULT_PREFIX}${JSON.stringify(results)}\n`;
+		expect(parseResults(output, "flux-load")).toEqual(results);
+	});
+
+	it("fails, naming the suite, when there is no result line", () => {
+		expect(() => parseResults("crashed\n", "flux-serve")).toThrow(/flux-serve/);
+	});
+});
+
+describe("fromVitest", () => {
+	it("maps forge benchmarks to stable ids, keeping the file count out of the label", () => {
+		expect(fromVitest(vitestOutput)).toEqual([
+			{
+				id: "forge.build.local",
+				label: "forge build es6 + types",
+				unit: "ms",
+				median: 64,
+				min: 60,
+				max: 80,
+				samples: 5,
+				files: 18,
+			},
+			// No median from vitest: the mean stands in.
+			expect.objectContaining({ id: "forge.build.debug", median: 10, files: 18 }),
+		]);
+	});
+
+	it("fails on a benchmark it has no id for, instead of charting it under a moving name", () => {
+		const output = {
+			files: [{ groups: [{ benchmarks: [{ name: "something new", mean: 1 }] }] }],
+		};
+		expect(() => fromVitest(output)).toThrow(/something new/);
+	});
+});
+
+describe("assertValid", () => {
+	it("passes real results and rejects NaN or empty ones, naming them", () => {
+		expect(() => assertValid([result("a", 1)])).not.toThrow();
+		expect(() =>
+			assertValid([result("a", 1), result("b", Number.NaN), result("c", 2, { samples: 0 })]),
+		).toThrow(/b, c/);
+	});
+});
+
+describe("normalize", () => {
+	it("keeps a version 2 history as it is", () => {
+		const history = { version: 2, contexts: { x: { context: ctx, runs: [] } } };
+		expect(normalize(history)).toBe(history);
+	});
+
+	it("converts version 1 forge runs so their trend carries on", () => {
+		const v1 = {
+			runs: {
+				abc: {
+					context: ctx,
+					runs: [{ date: "2026-08-12T14:18:10Z", context: ctx, vitestOutput }],
+				},
+				empty: { context: ctx, runs: [] },
+			},
+		};
+		const history = normalize(v1);
+		expect(Object.keys(history.contexts)).toEqual(["abc"]);
+		expect(history.contexts.abc.runs[0]).toMatchObject({
+			date: "2026-08-12T14:18:10Z",
+			sha: null,
+			results: [{ id: "forge.build.local" }, { id: "forge.build.debug" }],
+		});
+	});
+
+	it("starts empty when there is no history", () => {
+		expect(normalize(null)).toEqual({ version: 2, contexts: {} });
+	});
+});
+
+describe("appendRun / previousRun", () => {
+	const run = (day) => ({
+		date: `2026-10-${day}T03:17:00Z`,
+		sha: `sha${day}`,
+		results: [result("a", Number(day))],
+	});
+
+	it("puts the new run first, trims to the limit, and leaves the input untouched", () => {
+		const empty = normalize(null);
+		const one = appendRun(empty, ctx, run("18"), 2);
+		const two = appendRun(one, ctx, run("19"), 2);
+		const three = appendRun(two, ctx, run("20"), 2);
+
+		expect(empty.contexts).toEqual({});
+		expect(one.contexts[contextId(ctx)].runs).toHaveLength(1);
+		expect(three.contexts[contextId(ctx)].runs.map((r) => r.sha)).toEqual(["sha20", "sha19"]);
+		expect(previousRun(three, contextId(ctx))?.sha).toBe("sha20");
+		expect(previousRun(three, "other-machine")).toBeUndefined();
+	});
+});
+
+describe("compare / formatComparison", () => {
+	it("reports the change in median against the previous run, and n/a for new benchmarks", () => {
+		const rows = compare([result("a", 120), result("new", 5)], {
+			results: [result("a", 100)],
+		});
+		expect(rows).toEqual([
+			{ id: "a", current: 120, previous: 100, delta: 20, percent: 20 },
+			{ id: "new", current: 5 },
+		]);
+
+		const table = formatComparison(rows).split("\n");
+		expect(table[0]).toMatch(/^Benchmark \| +Median \| Previous \| +Delta \| +%$/);
+		expect(table[2]).toMatch(/^a +\| +120\.0 ms \| +100\.0 ms \| +\+20\.0 ms \| \+20\.0%$/);
+		expect(table[3]).toMatch(/^new +\| +5\.0 ms \| +n\/a \| +n\/a \| +n\/a$/);
+	});
+
+	it("compares against nothing on a machine's first run", () => {
+		expect(compare([result("a", 1)], undefined)).toEqual([{ id: "a", current: 1 }]);
+	});
+});
+
+describe("findRegressions", () => {
+	// Newest first, like the history: one run per night with this median for "a".
+	const nights = (...medians) =>
+		medians.map((median, index) => ({
+			date: `2026-10-${String(30 - index).padStart(2, "0")}T03:17:00Z`,
+			sha: `sha${30 - index}`,
+			results: [result("a", median)],
+		}));
+
+	it("flags a benchmark over the threshold on the last two nights, against the runs before", () => {
+		const [regression] = findRegressions(nights(130, 125, 100, 101, 99, 100, 102));
+		expect(regression).toMatchObject({
+			id: "a",
+			baseline: 100,
+			recent: [
+				{ sha: "sha30", median: 130 },
+				{ sha: "sha29", median: 125 },
+			],
+			lastGood: { sha: "sha28" },
+		});
+		expect(regression.percent).toBeCloseTo(30);
+	});
+
+	it("ignores one slow night, which is as likely the runner as the code", () => {
+		expect(findRegressions(nights(150, 100, 100, 101, 99, 100))).toEqual([]);
+	});
+
+	it("ignores slowdowns within the threshold", () => {
+		expect(findRegressions(nights(115, 118, 100, 100, 100))).toEqual([]);
+	});
+
+	it("waits for enough history to have a baseline", () => {
+		expect(findRegressions(nights(200, 200, 100, 100))).toEqual([]);
+		expect(findRegressions(nights(200))).toEqual([]);
+	});
+
+	it("uses only the baselineRuns runs before the slow ones", () => {
+		// Old runs at 300 would hide the regression if they were in the baseline.
+		const runs = nights(130, 130, 100, 100, 100, 300, 300, 300, 300, 300);
+		const options = { threshold: 0.2, confirmRuns: 2, baselineRuns: 3, minBaseline: 3 };
+		expect(findRegressions(runs, options).map((r) => r.baseline)).toEqual([100]);
+	});
+});

package/tests/bench/regression-issue.test.mjs

@@ -0,0 +1,50 @@
+import { describe, expect, it } from "vitest";
+import { issueBody, issueTitle } from "../../src/bench/regression-issue.mjs";
+
+const regression = {
+	id: "flux.load.cold",
+	label: "flux load, first import (cold process)",
+	baseline: 300,
+	percent: 33.3,
+	recent: [
+		{ date: "2026-10-22T03:17:00Z", sha: "cccccccccccccccc", median: 400 },
+		{ date: "2026-10-21T03:17:00Z", sha: "bbbbbbbbbbbbbbbb", median: 390 },
+	],
+	lastGood: { date: "2026-10-20T03:17:00Z", sha: "aaaaaaaaaaaaaaaa" },
+};
+const context = {
+	repoUrl: "https://github.com/typesmiths/decohere",
+	runUrl: "https://github.com/typesmiths/decohere/actions/runs/1",
+	machine: "gh-actions-node24, Test CPU × 4",
+	threshold: 0.2,
+};
+
+describe("regression issue", () => {
+	it("has one stable title per benchmark, so the nightly run finds and updates it", () => {
+		expect(issueTitle(regression)).toBe("perf(bench): flux.load.cold is slower");
+	});
+
+	it("gives the numbers, the commits to look at, and how to reproduce", () => {
+		const body = issueBody(regression, context);
+		expect(body).toContain(
+			"median 33% above its baseline, on each of the last 2 nightly runs",
+		);
+		expect(body).toContain("- Baseline (median of the runs before): **300.0 ms**");
+		expect(body).toContain(
+			"- 2026-10-22, [`ccccccc`](https://github.com/typesmiths/decohere/commit/cccccccccccccccc): **400.0 ms**",
+		);
+		expect(body).toContain(
+			"(https://github.com/typesmiths/decohere/compare/aaaaaaaaaaaaaaaa...cccccccccccccccc)",
+		);
+		expect(body).toContain("`pnpm bench:save`");
+		expect(body).toContain(context.runUrl);
+	});
+
+	it("says the range is unknown when the baseline run has no commit (converted old history)", () => {
+		const body = issueBody(
+			{ ...regression, lastGood: { date: "2026-08-12T00:00:00Z", sha: null } },
+			context,
+		);
+		expect(body).toContain("unknown (no baseline commit recorded)");
+	});
+});

package/tests/github/credential-nudge.test.mjs

@@ -0,0 +1,65 @@
+import { describe, expect, it } from "vitest";
+import {
+	assessTokenLifetime,
+	buildDescription,
+	CREDENTIALS,
+	credentialProfile,
+	ghScopeFlags,
+	parseExpiresAt,
+	rotationCommands,
+	suggestedNextExpiry,
+	taskName,
+} from "../../src/github/credential-nudge.mjs";
+
+describe("credential-nudge", () => {
+	it("parses YYYY-MM-DD as a UTC day", () => {
+		expect(parseExpiresAt("2026-11-19")).toBe(Date.UTC(2026, 10, 19));
+		expect(parseExpiresAt("")).toBeNull();
+	});
+
+	it("is ok more than 14 days out, warns inside the window, expires on the day", () => {
+		const expiresAtMs = Date.UTC(2026, 10, 19);
+		const now = (day) => Date.UTC(2026, 10, day, 15);
+		expect(assessTokenLifetime({ now: now(1), expiresAtMs }).kind).toBe("ok");
+		expect(assessTokenLifetime({ now: now(5), expiresAtMs })).toEqual({
+			kind: "warn",
+			daysLeft: 14,
+		});
+		expect(assessTokenLifetime({ now: now(18), expiresAtMs }).kind).toBe("warn");
+		expect(assessTokenLifetime({ now: now(19), expiresAtMs })).toEqual({
+			kind: "expired",
+			daysLeft: 0,
+		});
+		expect(assessTokenLifetime({ now: now(20), expiresAtMs }).kind).toBe("expired");
+		expect(assessTokenLifetime({ expiresAtMs: null }).kind).toBe("missing");
+	});
+
+	it("parameterizes GHCR vs npm rotate commands without duplicating date logic", () => {
+		const ghcr = credentialProfile("ghcr");
+		const npm = credentialProfile("npm");
+		expect(ghScopeFlags(ghcr)).toBe("--env ghcr-publish ");
+		expect(ghScopeFlags(npm)).toBe("");
+		expect(rotationCommands(ghcr, "2027-02-17", "typesmiths/decohere")).toContain(
+			"gh secret set GHCR_PUSH_TOKEN --env ghcr-publish --repo typesmiths/decohere",
+		);
+		expect(rotationCommands(npm, "2027-02-17", "typesmiths/decohere")).toContain(
+			"gh secret set NODE_AUTH_TOKEN --repo typesmiths/decohere",
+		);
+		expect(rotationCommands(npm, "2027-02-17", "typesmiths/decohere")).toContain(
+			"gh variable set NODE_AUTH_TOKEN_EXPIRES_AT --repo typesmiths/decohere --body 2027-02-17",
+		);
+		expect(taskName(npm, "2026-11-19")).toBe(
+			"chore(security): rotate NODE_AUTH_TOKEN (expires 2026-11-19)",
+		);
+		const body = buildDescription(ghcr, {
+			kind: "warn",
+			expiresYmd: "2026-11-19",
+			daysLeft: 14,
+			rejected: false,
+		});
+		expect(body).toContain("Docker login/push and the `v*` tag will **fail**");
+		expect(CREDENTIALS.npm.secret).toBe("NODE_AUTH_TOKEN");
+		expect(suggestedNextExpiry(Date.UTC(2026, 7, 21), 90)).toBe("2026-11-19");
+		expect(() => credentialProfile("nope")).toThrow(/Unknown NUDGE_CREDENTIAL/);
+	});
+});

package/tests/github/oidc-bootstrap-nudge.test.mjs

@@ -0,0 +1,104 @@
+import { describe, expect, it } from "vitest";
+import {
+	bootstrapTaskNames,
+	buildDescription,
+	extractGitHubReviewerLogins,
+	firstPublishCommands,
+	mapLoginsToClickUpIds,
+	needsPrereleaseTag,
+	parseAssigneeIds,
+	parseUnpublished,
+	runNudge,
+	taskName,
+} from "../../src/github/oidc-bootstrap-nudge.mjs";
+
+describe("oidc-bootstrap-nudge", () => {
+	it("parses unpublished names and assignee ids", () => {
+		expect(parseUnpublished(" @decohere/scaffold  @decohere/cli ")).toEqual([
+			"@decohere/scaffold",
+			"@decohere/cli",
+		]);
+		expect(parseAssigneeIds("308432336, 99")).toEqual([308432336, 99]);
+		expect(parseAssigneeIds("")).toEqual([]);
+		expect(taskName()).toBe("deploy(publish): OIDC bootstrap unpublished packages");
+		expect(bootstrapTaskNames()).toContain(
+			"chore(publish): OIDC bootstrap unpublished packages",
+		);
+	});
+
+	it("extracts GitHub user reviewers and maps login to ClickUp email local-part", () => {
+		expect(
+			extractGitHubReviewerLogins({
+				protection_rules: [
+					{ type: "branch_policy", reviewers: [] },
+					{
+						type: "required_reviewers",
+						reviewers: [
+							{ type: "User", reviewer: { login: "das974" } },
+							{ type: "Team", reviewer: { slug: "publishers", login: "should-skip" } },
+						],
+					},
+				],
+			}),
+		).toEqual(["das974"]);
+		expect(
+			mapLoginsToClickUpIds(
+				["das974"],
+				[{ id: 308432336, username: "Daniel Scalamogna", email: "das974@gmail.com" }],
+			),
+		).toEqual([308432336]);
+		expect(mapLoginsToClickUpIds(["other"], [{ id: 1, email: "das974@gmail.com" }])).toEqual(
+			[],
+		);
+	});
+
+	it("puts first-publish commands and Trusted Publisher fields in the task body", () => {
+		const pkg = { name: "@decohere/scaffold", dir: "scaffold", version: "0.0.1-dev.18" };
+		const body = buildDescription({
+			unpublished: ["@decohere/scaffold"],
+			packages: [pkg],
+			repo: "typesmiths/decohere",
+			runUrl: "https://github.com/typesmiths/decohere/actions/runs/9",
+			channel: "dev",
+		});
+		expect(needsPrereleaseTag("0.0.1-dev.18")).toBe(true);
+		expect(needsPrereleaseTag("1.2.3")).toBe(false);
+		expect(firstPublishCommands([pkg], "dev")).toEqual([
+			"npm publish ./projects/scaffold --tag dev",
+		]);
+		expect(firstPublishCommands([{ ...pkg, version: "1.0.0" }], "dev")).toEqual([
+			"npm publish ./projects/scaffold",
+		]);
+		expect(body).toContain("npm publish ./projects/scaffold --tag dev");
+		expect(body).not.toMatch(/# @decohere\/scaffold/);
+		expect(body).toContain("do **not** pass `--access public`");
+		expect(firstPublishCommands([pkg], "dev").join("\n")).not.toContain("--access public");
+		expect(body).toContain("Workflow filename: `publish.yml`");
+		expect(body).toContain("Environment: `npm-publish`");
+		expect(body).toContain("gh run rerun --failed");
+		expect(body).toContain("https://github.com/typesmiths/decohere/actions/runs/9");
+	});
+
+	it("assigns mapped GitHub reviewers when upserting the ClickUp task", async () => {
+		/** @type {object[]} */
+		const upserts = [];
+		const code = await runNudge(
+			{ UNPUBLISHED: "@decohere/scaffold", GITHUB_REPOSITORY: "typesmiths/decohere" },
+			{
+				listPackages: () => [{ name: "@decohere/scaffold", dir: "scaffold" }],
+				githubReviewers: async () => ["das974"],
+				clickupMembers: async () => [
+					{ id: 308432336, username: "Daniel Scalamogna", email: "das974@gmail.com" },
+				],
+				upsert: async (options) => {
+					upserts.push(options);
+					return { id: "abc", url: "https://app.clickup.com/t/abc", created: true };
+				},
+				runUrl: "https://github.com/typesmiths/decohere/actions/runs/1",
+			},
+		);
+		expect(code).toBe(0);
+		expect(upserts[0].assigneeIds).toEqual([308432336]);
+		expect(upserts[0].unpublished).toEqual(["@decohere/scaffold"]);
+	});
+});

package/tests/github/publish-verify.test.mjs

@@ -0,0 +1,95 @@
+import { vol } from "memfs";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+	collectPublishVerify,
+	formatGithubOutput,
+	listPublishablePackages,
+	parseGhcrRepository,
+} from "../../src/github/publish-verify.mjs";
+
+function seedWorkspace() {
+	const root = "/workspace";
+	vol.fromJSON({
+		[`${root}/package.json`]: JSON.stringify({ version: "0.0.1-dev.79" }),
+		[`${root}/projects/cli/package.json`]: JSON.stringify({
+			name: "@decohere/cli",
+			version: "0.0.1-dev.79",
+		}),
+		[`${root}/projects/scaffold/package.json`]: JSON.stringify({
+			name: "@decohere/scaffold",
+			version: "0.0.1-dev.79",
+			private: true,
+		}),
+		[`${root}/projects/create/package.json`]: JSON.stringify({
+			name: "@decohere/create",
+			version: "0.0.1-dev.79",
+			decohere: { dockerImageRepository: "ghcr.io/typesmiths/decohere/create" },
+		}),
+		[`${root}/projects/devcontainer/package.json`]: JSON.stringify({
+			name: "@decohere/devcontainer",
+			private: true,
+			decohere: { dockerImageRepository: "ghcr.io/typesmiths/decohere/devcontainer" },
+		}),
+	});
+	return root;
+}
+
+afterEach(() => {
+	vol.reset();
+});
+
+describe("publish-verify", () => {
+	it("lists non-private workspace packages", () => {
+		const root = seedWorkspace();
+		expect(listPublishablePackages(root).map((pkg) => pkg.name)).toEqual([
+			"@decohere/cli",
+			"@decohere/create",
+		]);
+	});
+
+	it("parses GHCR repository coordinates", () => {
+		expect(parseGhcrRepository("ghcr.io/typesmiths/decohere/create")).toEqual({
+			org: "typesmiths",
+			packageName: "decohere/create",
+		});
+	});
+
+	it("marks names missing from npm as unpublished and skip_npm when every version exists", async () => {
+		const root = seedWorkspace();
+		const views = [];
+		const spawnSync = (_cmd, args) => {
+			views.push(args[1]);
+			if (args[1] === "@decohere/cli") {
+				return { status: 1 };
+			}
+			return { status: 0 };
+		};
+		const result = await collectPublishVerify({
+			root,
+			spawnSync,
+			githubToken: "",
+		});
+		expect(result.unpublished).toEqual(["@decohere/cli"]);
+		expect(result.skipNpm).toBe(false);
+		expect(views).toContain("@decohere/cli");
+		expect(views).toContain("@decohere/create");
+		expect(views).toContain("@decohere/create@0.0.1-dev.79");
+	});
+
+	it("sets skip_docker when both GHCR tags exist", async () => {
+		const root = seedWorkspace();
+		const fetch = async () => ({
+			ok: true,
+			status: 200,
+			json: async () => [{ metadata: { container: { tags: ["0.0.1-dev.79"] } } }],
+		});
+		const result = await collectPublishVerify({
+			root,
+			spawnSync: () => ({ status: 0 }),
+			githubToken: "ghs_test",
+			fetch,
+		});
+		expect(result.skipDocker).toBe(true);
+		expect(formatGithubOutput(result)).toContain("skip_docker=true");
+	});
+});