@decohere/ci-tools 0.0.1-dev.111 → 0.0.1-dev.113

package/tests/bench/regression-issue.test.mjs

@@ -4,19 +4,21 @@ import { issueBody, issueTitle } from "../../src/bench/regression-issue.mjs";
 const regression = {
 	id: "flux.load.cold",
 	label: "flux load, first import (cold process)",
-	baseline: 300,
+	base: 300,
+	head: 400,
 	percent: 33.3,
-	recent: [
-		{ date: "2026-10-22T03:17:00Z", sha: "cccccccccccccccc", median: 400 },
-		{ date: "2026-10-21T03:17:00Z", sha: "bbbbbbbbbbbbbbbb", median: 390 },
+	rounds: [
+		{ base: 300, head: 395 },
+		{ base: 300, head: 405 },
 	],
-	lastGood: { date: "2026-10-20T03:17:00Z", sha: "aaaaaaaaaaaaaaaa" },
 };
 const context = {
 	repoUrl: "https://github.com/typesmiths/decohere",
 	runUrl: "https://github.com/typesmiths/decohere/actions/runs/1",
 	machine: "gh-actions-node24, Test CPU × 4",
 	threshold: 0.2,
+	base: "aaaaaaaaaaaaaaaa",
+	head: "cccccccccccccccc",
 };
 
 describe("regression issue", () => {
@@ -24,27 +26,17 @@ describe("regression issue", () => {
 		expect(issueTitle(regression)).toBe("perf(bench): flux.load.cold is slower");
 	});
 
-	it("gives the numbers, the commits to look at, and how to reproduce", () => {
+	it("gives both rounds, the commit range and how to reproduce", () => {
 		const body = issueBody(regression, context);
 		expect(body).toContain(
-			"median 33% above its baseline, on each of the last 2 nightly runs",
-		);
-		expect(body).toContain("- Baseline (median of the runs before): **300.0 ms**");
-		expect(body).toContain(
-			"- 2026-10-22, [`ccccccc`](https://github.com/typesmiths/decohere/commit/cccccccccccccccc): **400.0 ms**",
+			"is 33% slower on [`ccccccc`](https://github.com/typesmiths/decohere/commit/cccccccccccccccc)",
 		);
+		expect(body).toContain("| 1 | 300.0 ms | 395.0 ms |");
+		expect(body).toContain("| 2 | 300.0 ms | 405.0 ms |");
 		expect(body).toContain(
 			"(https://github.com/typesmiths/decohere/compare/aaaaaaaaaaaaaaaa...cccccccccccccccc)",
 		);
-		expect(body).toContain("`pnpm bench:save`");
+		expect(body).toContain("check out `aaaaaaa`, run `pnpm bench:save`");
 		expect(body).toContain(context.runUrl);
 	});
-
-	it("says the range is unknown when the baseline run has no commit (converted old history)", () => {
-		const body = issueBody(
-			{ ...regression, lastGood: { date: "2026-08-12T00:00:00Z", sha: null } },
-			context,
-		);
-		expect(body).toContain("unknown (no baseline commit recorded)");
-	});
 });

package/tests/github/credential-nudge.test.mjs

@@ -5,12 +5,32 @@ import {
 	CREDENTIALS,
 	credentialProfile,
 	ghScopeFlags,
+	issueTitle,
 	parseExpiresAt,
 	rotationCommands,
+	runNudge,
 	suggestedNextExpiry,
-	taskName,
 } from "../../src/github/credential-nudge.mjs";
 
+/** Records each upsert and answers like a newly opened issue. */
+function recordUpserts() {
+	/** @type {{ title: string, body: string }[]} */
+	const upserts = [];
+	const upsert = (options) => {
+		upserts.push(options);
+		return {
+			number: 9,
+			url: "https://github.com/typesmiths/decohere/issues/9",
+			created: true,
+		};
+	};
+	return { upserts, upsert };
+}
+
+function inDays(days) {
+	return suggestedNextExpiry(Date.now(), days);
+}
+
 describe("credential-nudge", () => {
 	it("parses YYYY-MM-DD as a UTC day", () => {
 		expect(parseExpiresAt("2026-11-19")).toBe(Date.UTC(2026, 10, 19));
@@ -48,7 +68,7 @@ describe("credential-nudge", () => {
 		expect(rotationCommands(npm, "2027-02-17", "typesmiths/decohere")).toContain(
 			"gh variable set NODE_AUTH_TOKEN_EXPIRES_AT --repo typesmiths/decohere --body 2027-02-17",
 		);
-		expect(taskName(npm, "2026-11-19")).toBe(
+		expect(issueTitle(npm, "2026-11-19")).toBe(
 			"chore(security): rotate NODE_AUTH_TOKEN (expires 2026-11-19)",
 		);
 		const body = buildDescription(ghcr, {
@@ -62,4 +82,35 @@ describe("credential-nudge", () => {
 		expect(suggestedNextExpiry(Date.UTC(2026, 7, 21), 90)).toBe("2026-11-19");
 		expect(() => credentialProfile("nope")).toThrow(/Unknown NUDGE_CREDENTIAL/);
 	});
+
+	it("files nothing and passes while the token has more than 14 days left", async () => {
+		const { upserts, upsert } = recordUpserts();
+		const env = { NUDGE_CREDENTIAL: "npm", NODE_AUTH_TOKEN_EXPIRES_AT: inDays(30) };
+		expect(await runNudge(env, upsert)).toBe(0);
+		expect(upserts).toEqual([]);
+	});
+
+	it("files a rotation issue but lets Publish continue inside the warning window", async () => {
+		const { upserts, upsert } = recordUpserts();
+		const expires = inDays(10);
+		const env = { NUDGE_CREDENTIAL: "npm", NODE_AUTH_TOKEN_EXPIRES_AT: expires };
+		expect(await runNudge(env, upsert)).toBe(0);
+		expect(upserts).toHaveLength(1);
+		expect(upserts[0].title).toBe(
+			`chore(security): rotate NODE_AUTH_TOKEN (expires ${expires})`,
+		);
+		expect(upserts[0].body).toContain("Close this issue, then retry Publish");
+	});
+
+	it("files a rotation issue and stops Publish once the token has expired or was rejected", async () => {
+		const expired = recordUpserts();
+		const env = { NUDGE_CREDENTIAL: "ghcr", GHCR_TOKEN_EXPIRES_AT: inDays(0) };
+		expect(await runNudge(env, expired.upsert)).toBe(1);
+		expect(expired.upserts).toHaveLength(1);
+
+		const rejected = recordUpserts();
+		const rejectedEnv = { ...env, GHCR_TOKEN_EXPIRES_AT: inDays(60), NUDGE_REJECTED: "1" };
+		expect(await runNudge(rejectedEnv, rejected.upsert)).toBe(1);
+		expect(rejected.upserts[0].body).toContain(CREDENTIALS.ghcr.rejectedWhy);
+	});
 });

package/tests/github/oidc-bootstrap-nudge.test.mjs

@@ -1,32 +1,24 @@
 import { describe, expect, it } from "vitest";
 import {
-	bootstrapTaskNames,
 	buildDescription,
 	extractGitHubReviewerLogins,
 	firstPublishCommands,
-	mapLoginsToClickUpIds,
+	issueTitle,
 	needsPrereleaseTag,
-	parseAssigneeIds,
 	parseUnpublished,
 	runNudge,
-	taskName,
 } from "../../src/github/oidc-bootstrap-nudge.mjs";
 
 describe("oidc-bootstrap-nudge", () => {
-	it("parses unpublished names and assignee ids", () => {
+	it("parses unpublished names", () => {
 		expect(parseUnpublished(" @decohere/scaffold  @decohere/cli ")).toEqual([
 			"@decohere/scaffold",
 			"@decohere/cli",
 		]);
-		expect(parseAssigneeIds("308432336, 99")).toEqual([308432336, 99]);
-		expect(parseAssigneeIds("")).toEqual([]);
-		expect(taskName()).toBe("deploy(publish): OIDC bootstrap unpublished packages");
-		expect(bootstrapTaskNames()).toContain(
-			"chore(publish): OIDC bootstrap unpublished packages",
-		);
+		expect(issueTitle()).toBe("deploy(publish): OIDC bootstrap unpublished packages");
 	});
 
-	it("extracts GitHub user reviewers and maps login to ClickUp email local-part", () => {
+	it("extracts GitHub user reviewers and skips teams", () => {
 		expect(
 			extractGitHubReviewerLogins({
 				protection_rules: [
@@ -41,15 +33,6 @@ describe("oidc-bootstrap-nudge", () => {
 				],
 			}),
 		).toEqual(["das974"]);
-		expect(
-			mapLoginsToClickUpIds(
-				["das974"],
-				[{ id: 308432336, username: "Daniel Scalamogna", email: "das974@gmail.com" }],
-			),
-		).toEqual([308432336]);
-		expect(mapLoginsToClickUpIds(["other"], [{ id: 1, email: "das974@gmail.com" }])).toEqual(
-			[],
-		);
 	});
 
 	it("puts first-publish commands and Trusted Publisher fields in the task body", () => {
@@ -79,7 +62,7 @@ describe("oidc-bootstrap-nudge", () => {
 		expect(body).toContain("https://github.com/typesmiths/decohere/actions/runs/9");
 	});
 
-	it("assigns mapped GitHub reviewers when upserting the ClickUp task", async () => {
+	it("assigns the bootstrap environment's reviewers to the issue", async () => {
 		/** @type {object[]} */
 		const upserts = [];
 		const code = await runNudge(
@@ -87,18 +70,20 @@ describe("oidc-bootstrap-nudge", () => {
 			{
 				listPackages: () => [{ name: "@decohere/scaffold", dir: "scaffold" }],
 				githubReviewers: async () => ["das974"],
-				clickupMembers: async () => [
-					{ id: 308432336, username: "Daniel Scalamogna", email: "das974@gmail.com" },
-				],
-				upsert: async (options) => {
+				upsert: (options) => {
 					upserts.push(options);
-					return { id: "abc", url: "https://app.clickup.com/t/abc", created: true };
+					return {
+						number: 5,
+						url: "https://github.com/typesmiths/decohere/issues/5",
+						created: true,
+					};
 				},
 				runUrl: "https://github.com/typesmiths/decohere/actions/runs/1",
 			},
 		);
 		expect(code).toBe(0);
-		expect(upserts[0].assigneeIds).toEqual([308432336]);
-		expect(upserts[0].unpublished).toEqual(["@decohere/scaffold"]);
+		expect(upserts[0].title).toBe(issueTitle());
+		expect(upserts[0].assignees).toEqual(["das974"]);
+		expect(upserts[0].body).toContain("`@decohere/scaffold`");
 	});
 });

package/tests/lib/github-issue.test.mjs

@@ -0,0 +1,74 @@
+import { describe, expect, it } from "vitest";
+import { pickIssue, upsertIssue } from "../../src/lib/github-issue.mjs";
+
+const TITLE = "chore(security): rotate NODE_AUTH_TOKEN (expires 2026-11-19)";
+
+/** A fake `gh` that answers `issue list` with `issues` and records every call. */
+function fakeGh(issues) {
+	/** @type {{ args: string[], input?: string }[]} */
+	const calls = [];
+	const run = (args, input) => {
+		calls.push({ args, input });
+		if (args[1] === "list") return JSON.stringify(issues);
+		if (args[1] === "create") return "https://github.com/typesmiths/decohere/issues/42\n";
+		return "";
+	};
+	return { run, calls };
+}
+
+describe("github-issue", () => {
+	it("matches the exact title only and prefers an open issue", () => {
+		const issues = [
+			{ number: 1, title: TITLE, state: "CLOSED", url: "u1" },
+			{ number: 2, title: `${TITLE} (old)`, state: "OPEN", url: "u2" },
+			{ number: 3, title: TITLE, state: "OPEN", url: "u3" },
+		];
+		expect(pickIssue(issues, TITLE)?.number).toBe(3);
+		expect(pickIssue(issues.slice(0, 2), TITLE)?.number).toBe(1);
+		expect(pickIssue([], TITLE)).toBeNull();
+	});
+
+	it("opens an issue with assignees when none has the title", () => {
+		const { run, calls } = fakeGh([]);
+		const result = upsertIssue({ title: TITLE, body: "body", assignees: ["das974"] }, run);
+		expect(result).toEqual({
+			number: 42,
+			url: "https://github.com/typesmiths/decohere/issues/42",
+			created: true,
+		});
+		expect(calls[1]).toEqual({
+			args: [
+				"issue",
+				"create",
+				"--title",
+				TITLE,
+				"--body-file",
+				"-",
+				"--add-assignee",
+				"das974",
+			],
+			input: "body",
+		});
+	});
+
+	it("updates an open issue's body in place", () => {
+		const { run, calls } = fakeGh([{ number: 7, title: TITLE, state: "OPEN", url: "u7" }]);
+		const result = upsertIssue({ title: TITLE, body: "new body" }, run);
+		expect(result).toEqual({ number: 7, url: "u7", created: false });
+		expect(calls.map((call) => call.args[1])).toEqual(["list", "edit"]);
+		expect(calls[1]).toEqual({
+			args: ["issue", "edit", "7", "--body-file", "-"],
+			input: "new body",
+		});
+	});
+
+	it("reopens a closed issue before updating it", () => {
+		const { run, calls } = fakeGh([{ number: 7, title: TITLE, state: "CLOSED", url: "u7" }]);
+		upsertIssue({ title: TITLE, body: "b", repo: "typesmiths/decohere" }, run);
+		expect(calls.map((call) => call.args.slice(0, 3))).toEqual([
+			["issue", "list", "--repo"],
+			["issue", "reopen", "7"],
+			["issue", "edit", "7"],
+		]);
+	});
+});

package/tests/pages/bench-page.test.mjs

@@ -81,6 +81,23 @@ describe("buildBenchmarkHtml", () => {
 		expect(html).toContain('<p class="when">Last run 2026-10-20 03:17 UTC</p>');
 	});
 
+	it("leaves out machine types with no run in the 30 days before the newest run", () => {
+		const html = buildBenchmarkHtml({
+			version: 2,
+			contexts: {
+				...history.contexts,
+				gone: {
+					context: context("gh-actions-node24-retired", 2),
+					runs: [
+						run("2026-08-01T03:17:00Z", "dddddddddddd", [result("flux.serve.start", 70)]),
+					],
+				},
+			},
+		});
+		expect(html).not.toContain("gh-actions-node24-retired");
+		expect(html).toContain("(local)");
+	});
+
 	it("escapes labels from the history", () => {
 		const html = buildBenchmarkHtml(history);
 		expect(html).toContain("spawn &lt;to&gt; ready");

package/src/audit/upsert-clickup.mjs

@@ -1,117 +0,0 @@
-/**
- * Upsert a ClickUp task with the current npm audit report.
- *
- * Env: CLICKUP_API_KEY (required), CLICKUP_LIST_ID (default Decohere list).
- */
-import { existsSync, readFileSync } from "node:fs";
-import { formatMarkdown, parseAudit } from "./format.mjs";
-
-const auditFilePath = process.argv[2] ?? "npm-audit.json";
-const TASK_NAME = "chore(security): npm audit findings";
-const LIST_ID = process.env.CLICKUP_LIST_ID ?? "901220171084";
-const API = "https://api.clickup.com/api/v2";
-
-function runUrl() {
-	if (
-		process.env.GITHUB_SERVER_URL &&
-		process.env.GITHUB_REPOSITORY &&
-		process.env.GITHUB_RUN_ID
-	) {
-		return `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
-	}
-	return "(run URL unavailable)";
-}
-
-async function clickup(method, path, body) {
-	const key = process.env.CLICKUP_API_KEY;
-	if (key == null || key.length === 0) {
-		throw new Error("Missing CLICKUP_API_KEY");
-	}
-	const response = await fetch(`${API}${path}`, {
-		method,
-		headers: {
-			Authorization: key,
-			"Content-Type": "application/json",
-		},
-		body: body == null ? undefined : JSON.stringify(body),
-	});
-	const text = await response.text();
-	if (!response.ok) {
-		throw new Error(
-			`ClickUp ${method} ${path} failed (${response.status}): ${text.slice(0, 500)}`,
-		);
-	}
-	return text.length === 0 ? undefined : JSON.parse(text);
-}
-
-async function findTaskByName(name) {
-	for (let page = 0; page < 10; page++) {
-		const qs = new URLSearchParams({
-			include_closed: "true",
-			subtasks: "false",
-			page: String(page),
-		});
-		const data = await clickup("GET", `/list/${LIST_ID}/task?${qs}`);
-		const tasks = Array.isArray(data) ? data : (data?.tasks ?? []);
-		const match = tasks.find((t) => t.name === name);
-		if (match) return match;
-		if (tasks.length < 100) break;
-	}
-	return null;
-}
-
-async function firstOpenStatus() {
-	const list = await clickup("GET", `/list/${LIST_ID}`);
-	return (list.statuses ?? []).find((s) => s.type === "open")?.status;
-}
-
-function buildDescription(parsed) {
-	const sha = process.env.GITHUB_SHA ? process.env.GITHUB_SHA.slice(0, 12) : "unknown";
-	return [
-		formatMarkdown(parsed).trim(),
-		"",
-		`- Commit: \`${sha}\``,
-		`- Workflow run: ${runUrl()}`,
-		"",
-		"Updated by the nightly npm-audit workflow. PR CI still gates high/critical.",
-	].join("\n");
-}
-
-if (!existsSync(auditFilePath)) {
-	console.log(`No audit file at ${auditFilePath}; skipping ClickUp upsert.`);
-	process.exit(0);
-}
-
-const parsed = parseAudit(JSON.parse(readFileSync(auditFilePath, "utf8")));
-const existing = await findTaskByName(TASK_NAME);
-
-if (parsed.total === 0) {
-	if (existing) {
-		await clickup("PUT", `/task/${existing.id}`, {
-			markdown_description: buildDescription(parsed),
-		});
-		console.log(`Cleared findings on ClickUp task ${existing.id}`);
-	} else {
-		console.log("No vulnerabilities and no existing ClickUp task; nothing to upsert.");
-	}
-	process.exit(0);
-}
-
-const payload = {
-	name: TASK_NAME,
-	markdown_description: buildDescription(parsed),
-	custom_item_id: 1004,
-};
-
-if (existing) {
-	const update = { markdown_description: payload.markdown_description };
-	if (existing.closed || existing.status?.type === "closed") {
-		const status = await firstOpenStatus();
-		if (status) update.status = status;
-	}
-	await clickup("PUT", `/task/${existing.id}`, update);
-	console.log(`Updated ClickUp task ${existing.id} (${existing.url ?? ""})`);
-} else {
-	const created = await clickup("POST", `/list/${LIST_ID}/task`, payload);
-	console.log(`Created ClickUp task ${created.id} ${created.url ?? ""}`);
-}