@decohere/ci-tools 0.0.1-dev.19 → 0.0.1-dev.20261105.103

package/tests/bench/regression-issue.test.mjs

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "vitest";
+import { issueBody, issueTitle } from "../../src/bench/regression-issue.mjs";
+
+const regression = {
+	id: "flux.load.cold",
+	label: "flux load, first import (cold process)",
+	base: 300,
+	head: 400,
+	percent: 33.3,
+	rounds: [
+		{ base: 300, head: 395 },
+		{ base: 300, head: 405 },
+	],
+};
+const context = {
+	repoUrl: "https://github.com/typesmiths/decohere",
+	runUrl: "https://github.com/typesmiths/decohere/actions/runs/1",
+	machine: "gh-actions-node24, Test CPU × 4",
+	threshold: 0.2,
+	base: "aaaaaaaaaaaaaaaa",
+	head: "cccccccccccccccc",
+};
+
+describe("regression issue", () => {
+	it("has one stable title per benchmark, so the nightly run finds and updates it", () => {
+		expect(issueTitle(regression)).toBe("perf(bench): flux.load.cold is slower");
+	});
+
+	it("gives both rounds, the commit range and how to reproduce", () => {
+		const body = issueBody(regression, context);
+		expect(body).toContain(
+			"is 33% slower on [`ccccccc`](https://github.com/typesmiths/decohere/commit/cccccccccccccccc)",
+		);
+		expect(body).toContain("| 1 | 300.0 ms | 395.0 ms |");
+		expect(body).toContain("| 2 | 300.0 ms | 405.0 ms |");
+		expect(body).toContain(
+			"(https://github.com/typesmiths/decohere/compare/aaaaaaaaaaaaaaaa...cccccccccccccccc)",
+		);
+		expect(body).toContain("check out `aaaaaaa`, run `pnpm bench:save`");
+		expect(body).toContain(context.runUrl);
+	});
+});

package/tests/github/ci-workflow.test.mjs

@@ -0,0 +1,30 @@
+import { fileURLToPath } from "node:url";
+import { describe, expect, it, vi } from "vitest";
+
+const fs = await vi.importActual("node:fs");
+const CI_YML = fileURLToPath(new URL("../../../../.github/workflows/ci.yml", import.meta.url));
+
+describe("ci.yml and the merge queue", () => {
+	const yml = fs.readFileSync(CI_YML, "utf8");
+	const triggers = yml.slice(yml.indexOf("\non:"), yml.indexOf("\nconcurrency:"));
+	const gate = yml.slice(yml.indexOf("- id: gate"), yml.indexOf("# Static gates"));
+
+	it("runs for queued pull requests, or the queue waits forever for the required check", () => {
+		expect(triggers).toMatch(/^\s+merge_group:/m);
+	});
+
+	it("runs the whole suite in the queue: the docs-only shortcut is only for pull requests", () => {
+		expect(gate).toContain('"${{ github.event_name }}" == "merge_group"');
+	});
+
+	it("makes the required check wait for every job, so a failing job can't be missed", () => {
+		const jobs = yml.slice(yml.indexOf("\njobs:"));
+		const names = [...jobs.matchAll(/^ {2}([a-z-]+):$/gm)].map((match) => match[1]);
+		const needs = /^ {2}ci:\n {4}needs: \[(.+)\]$/m.exec(jobs)?.[1].split(", ");
+
+		// `release` follows `ci`.
+		expect(needs?.toSorted()).toEqual(
+			names.filter((name) => name !== "ci" && name !== "release").toSorted(),
+		);
+	});
+});

package/tests/github/first-publish-check.test.mjs

@@ -0,0 +1,51 @@
+import { describe, expect, it } from "vitest";
+import { checkFirstPublish } from "../../src/github/first-publish-check.mjs";
+
+function fakeRegistry(statusByName) {
+	return async (url) => {
+		const name = decodeURIComponent(new URL(url).pathname.slice(1));
+		return new Response("{}", { status: statusByName[name] ?? 200 });
+	};
+}
+
+async function check(statusByName, blocking) {
+	const messages = [];
+	const code = await checkFirstPublish({
+		packages: ["@decohere/cli", "@decohere/shiny"],
+		blocking,
+		fetch: fakeRegistry(statusByName),
+		log: (message) => messages.push(message),
+	});
+	return { code, output: messages.join("\n") };
+}
+
+describe("checkFirstPublish", () => {
+	it("passes when every package is on npm", async () => {
+		const { code, output } = await check({}, true);
+
+		expect(code).toBe(0);
+		expect(output).toContain("All 2 packages are on npm");
+	});
+
+	it("only leaves a notice on a PR, so a contributor can propose a package", async () => {
+		const { code, output } = await check({ "@decohere/shiny": 404 }, false);
+
+		expect(code).toBe(0);
+		expect(output).toContain("::notice::");
+		expect(output).toContain("pnpm npm:bootstrap --otp <code> @decohere/shiny");
+	});
+
+	it("fails in the merge queue, naming the package and the command", async () => {
+		const { code, output } = await check({ "@decohere/shiny": 404 }, true);
+
+		expect(code).toBe(1);
+		expect(output).toContain("::error::");
+		expect(output).toContain("pnpm npm:bootstrap --otp <code> @decohere/shiny");
+	});
+
+	it("doesn't mistake an npm outage for a new package", async () => {
+		await expect(check({ "@decohere/shiny": 503 }, false)).rejects.toThrow(
+			"Could not check @decohere/shiny on npm: 503",
+		);
+	});
+});

package/tests/github/npm-bootstrap.test.mjs

@@ -0,0 +1,125 @@
+import { vol } from "memfs";
+import { afterEach, describe, expect, it } from "vitest";
+import { runBootstrap } from "../../src/github/npm-bootstrap.mjs";
+
+const root = "/workspace";
+
+function seedWorkspace() {
+	vol.fromJSON({
+		[`${root}/package.json`]: JSON.stringify({ version: "0.0.1-dev.5" }),
+		[`${root}/projects/scribe/scribe/package.json`]: JSON.stringify({
+			name: "@decohere/scribe",
+			version: "0.0.1-dev.5",
+		}),
+		[`${root}/projects/scribe/scribe-console/package.json`]: JSON.stringify({
+			name: "@decohere/scribe-console",
+			version: "0.0.1-dev.5",
+		}),
+	});
+}
+
+/**
+ * A fake registry: `published` names exist, and `trusted` names have a Trusted
+ * Publisher. Each call is recorded as its arguments, plus the code npm would
+ * get through NPM_CONFIG_OTP.
+ */
+function fakeNpm({ published = [], trusted = [], loggedIn = true } = {}) {
+	const calls = [];
+	const npm = (args, { otp } = {}) => {
+		calls.push(`${args.join(" ")}${otp ? ` [otp ${otp}]` : ""}`);
+		if (args[0] === "whoami") {
+			return { status: loggedIn ? 0 : 1, output: "" };
+		}
+		if (args[0] === "trust" && args[1] === "list") {
+			return trusted.includes(args[2])
+				? { status: 0, output: '[{"repository":"typesmiths/decohere","file":"publish.yml"}]' }
+				: { status: 0, output: "[]" };
+		}
+		return { status: 0, output: "" };
+	};
+	return { npm, calls, nameExists: (name) => published.includes(name) };
+}
+
+function run(argv, registry) {
+	const lines = [];
+	return runBootstrap({
+		argv,
+		root,
+		io: {
+			npm: registry.npm,
+			nameExists: registry.nameExists,
+			log: (line) => lines.push(line),
+		},
+	}).then((code) => ({ code, lines }));
+}
+
+afterEach(() => {
+	vol.reset();
+});
+
+describe("npm-bootstrap", () => {
+	it("first-publishes unpublished names public, then sets the Trusted Publisher", async () => {
+		seedWorkspace();
+		const registry = fakeNpm({ published: ["@decohere/scribe"] });
+
+		const { code } = await run(["--otp", "123456"], registry);
+
+		expect(code).toBe(0);
+		expect(registry.calls).toEqual([
+			"whoami",
+			"publish ./projects/scribe/scribe-console --access public --tag dev [otp 123456]",
+			"trust list @decohere/scribe-console --json [otp 123456]",
+			"trust github @decohere/scribe-console --file publish.yml --repo typesmiths/decohere --env npm-publish --allow-publish --yes [otp 123456]",
+		]);
+	});
+
+	it("skips the steps that are already done", async () => {
+		seedWorkspace();
+		const registry = fakeNpm({
+			published: ["@decohere/scribe-console"],
+			trusted: ["@decohere/scribe-console"],
+		});
+
+		const { code } = await run(["@decohere/scribe-console"], registry);
+
+		expect(code).toBe(0);
+		expect(registry.calls).toEqual(["whoami", "trust list @decohere/scribe-console --json"]);
+	});
+
+	/** `npm trust` rejects `--otp`: the code goes through the environment. */
+	it("never passes the code as an argument, and lets npm ask when none is given", async () => {
+		seedWorkspace();
+		const withCode = fakeNpm({ published: ["@decohere/scribe"] });
+		await run(["--otp", "604381"], withCode);
+		expect(withCode.calls.join("\n")).not.toContain("--otp");
+
+		const withoutCode = fakeNpm({ published: ["@decohere/scribe"] });
+		expect((await run([], withoutCode)).code).toBe(0);
+		expect(withoutCode.calls.join("\n")).not.toContain("otp");
+	});
+
+	it("prints the commands on a dry run, calling npm only to check the login", async () => {
+		seedWorkspace();
+		const registry = fakeNpm({ published: ["@decohere/scribe"] });
+
+		const { code, lines } = await run(["--dry-run"], registry);
+
+		expect(code).toBe(0);
+		expect(registry.calls).toEqual(["whoami"]);
+		expect(lines).toContain(
+			"[dry run] npm publish ./projects/scribe/scribe-console --access public --tag dev",
+		);
+	});
+
+	it("stops when not logged in, or for a name that is not a package", async () => {
+		seedWorkspace();
+		const loggedOut = fakeNpm({ loggedIn: false });
+		expect((await run(["--otp", "1"], loggedOut)).code).toBe(1);
+		expect(loggedOut.calls).toEqual(["whoami"]);
+
+		const typo = fakeNpm();
+		const { code, lines } = await run(["@decohere/scribe-consol"], typo);
+		expect(code).toBe(1);
+		expect(lines).toEqual(["Not a publishable package in projects/: @decohere/scribe-consol"]);
+	});
+});

package/tests/github/package-metadata.test.mjs

@@ -0,0 +1,69 @@
+import { join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+import { vol } from "memfs";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { listPublishablePackages } from "../../src/github/publish-verify.mjs";
+
+const fs = await vi.importActual("node:fs");
+const REPO_ROOT = fileURLToPath(new URL("../../../../", import.meta.url));
+const REPO = "https://github.com/typesmiths/decohere";
+
+/** The repo's real package.json files, loaded into the in-memory fs the tests run on. */
+function loadRealManifests() {
+	/** @type {Record<string, string>} */
+	const files = {};
+	const walk = (dir) => {
+		for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+			const path = join(dir, entry.name);
+			if (entry.isDirectory() && !["node_modules", "dist"].includes(entry.name)) {
+				walk(path);
+			} else if (entry.name === "package.json") {
+				files[join("/repo", relative(REPO_ROOT, path))] = fs.readFileSync(path, "utf8");
+			}
+		}
+	};
+	walk(join(REPO_ROOT, "projects"));
+	return files;
+}
+
+afterEach(() => {
+	vol.reset();
+});
+
+// npm shows these on each package's page, and Trusted Publishing's provenance is
+// checked against `repository.url`, so a package without it fails to publish.
+describe("published package metadata", () => {
+	vol.fromJSON(loadRealManifests());
+	const packages = listPublishablePackages("/repo").map((pkg) => ({
+		...pkg,
+		json: JSON.parse(String(vol.readFileSync(`/repo/projects/${pkg.dir}/package.json`))),
+	}));
+	vol.reset();
+
+	it("finds the publishable packages", () => {
+		expect(packages.length).toBeGreaterThan(0);
+	});
+
+	it.each(packages.map((pkg) => [pkg.name, pkg]))(
+		"%s links back to the repo",
+		(_name, pkg) => {
+			expect(pkg.json.repository).toEqual({
+				type: "git",
+				url: `git+${REPO}.git`,
+				directory: `projects/${pkg.dir}`,
+			});
+			expect(pkg.json.homepage).toBe(`${REPO}/tree/main/projects/${pkg.dir}#readme`);
+			expect(pkg.json.bugs).toEqual({ url: `${REPO}/issues` });
+		},
+	);
+
+	it.each(packages.map((pkg) => [pkg.name, pkg]))(
+		"%s has a description, keywords, license and author",
+		(_name, pkg) => {
+			expect(pkg.json.description).toBeTruthy();
+			expect(pkg.json.keywords?.length).toBeGreaterThan(0);
+			expect(pkg.json.license).toBe("ISC");
+			expect(pkg.json.author).toBeTruthy();
+		},
+	);
+});

package/tests/github/publish-verify.test.mjs

@@ -0,0 +1,115 @@
+import { vol } from "memfs";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+	collectPublishVerify,
+	formatGithubOutput,
+	listPublishablePackages,
+	parseGhcrRepository,
+} from "../../src/github/publish-verify.mjs";
+
+function seedWorkspace() {
+	const root = "/workspace";
+	vol.fromJSON({
+		[`${root}/package.json`]: JSON.stringify({ version: "0.0.1-dev.79" }),
+		[`${root}/projects/cli/package.json`]: JSON.stringify({
+			name: "@decohere/cli",
+			version: "0.0.1-dev.79",
+		}),
+		[`${root}/projects/scaffold/package.json`]: JSON.stringify({
+			name: "@decohere/scaffold",
+			version: "0.0.1-dev.79",
+			private: true,
+		}),
+		[`${root}/projects/create/package.json`]: JSON.stringify({
+			name: "@decohere/create",
+			version: "0.0.1-dev.79",
+			decohere: { dockerImageRepository: "ghcr.io/typesmiths/decohere/create" },
+		}),
+		[`${root}/projects/devcontainer/package.json`]: JSON.stringify({
+			name: "@decohere/devcontainer",
+			private: true,
+			decohere: { dockerImageRepository: "ghcr.io/typesmiths/decohere/devcontainer" },
+		}),
+	});
+	return root;
+}
+
+afterEach(() => {
+	vol.reset();
+});
+
+describe("publish-verify", () => {
+	it("lists non-private workspace packages", () => {
+		const root = seedWorkspace();
+		expect(listPublishablePackages(root).map((pkg) => pkg.name)).toEqual([
+			"@decohere/cli",
+			"@decohere/create",
+		]);
+	});
+
+	it("lists grouped packages (projects/<group>/<name>) and skips nested and build folders", () => {
+		const root = seedWorkspace();
+		vol.fromJSON({
+			[`${root}/projects/data/data/package.json`]: JSON.stringify({ name: "@decohere/data" }),
+			[`${root}/projects/data/data-typeorm/package.json`]: JSON.stringify({
+				name: "@decohere/data-typeorm",
+			}),
+			[`${root}/projects/cli/examples/demo/package.json`]: JSON.stringify({ name: "nested" }),
+			[`${root}/projects/__fixtures__/app/package.json`]: JSON.stringify({ name: "fixture" }),
+			[`${root}/projects/node_modules/dep/package.json`]: JSON.stringify({ name: "dep" }),
+			[`${root}/projects/dist/out/package.json`]: JSON.stringify({ name: "built" }),
+		});
+		expect(listPublishablePackages(root).map((pkg) => pkg.name)).toEqual([
+			"@decohere/cli",
+			"@decohere/create",
+			"@decohere/data",
+			"@decohere/data-typeorm",
+		]);
+	});
+
+	it("parses GHCR repository coordinates", () => {
+		expect(parseGhcrRepository("ghcr.io/typesmiths/decohere/create")).toEqual({
+			org: "typesmiths",
+			packageName: "decohere/create",
+		});
+	});
+
+	it("marks names missing from npm as unpublished and skip_npm when every version exists", async () => {
+		const root = seedWorkspace();
+		const views = [];
+		const spawnSync = (_cmd, args) => {
+			views.push(args[1]);
+			if (args[1] === "@decohere/cli") {
+				return { status: 1 };
+			}
+			return { status: 0 };
+		};
+		const result = await collectPublishVerify({
+			root,
+			spawnSync,
+			githubToken: "",
+		});
+		expect(result.unpublished).toEqual(["@decohere/cli"]);
+		expect(result.skipNpm).toBe(false);
+		expect(views).toContain("@decohere/cli");
+		expect(views).toContain("@decohere/create");
+		expect(views).toContain("@decohere/create@0.0.1-dev.79");
+	});
+
+	it("sets skip_docker when both GHCR tags exist", async () => {
+		const root = seedWorkspace();
+		const fetch = async () => ({
+			ok: true,
+			status: 200,
+			json: async () => [{ metadata: { container: { tags: ["0.0.1-dev.79"] } } }],
+		});
+		const result = await collectPublishVerify({
+			root,
+			spawnSync: () => ({ status: 0 }),
+			githubToken: "ghs_test",
+			fetch,
+		});
+		expect(result.skipDocker).toBe(true);
+		expect(formatGithubOutput(result)).toContain("skip_docker=true");
+	});
+});

package/tests/github/smoke-create-launcher.test.mjs

@@ -0,0 +1,132 @@
+import { fileURLToPath } from "node:url";
+import { describe, expect, it, vi } from "vitest";
+import { runCreateLauncherSmoke } from "../../src/github/smoke-create-launcher.mjs";
+
+const fs = await vi.importActual("node:fs");
+const PUBLISH_YML = fileURLToPath(
+	new URL("../../../../.github/workflows/publish.yml", import.meta.url),
+);
+
+describe("runCreateLauncherSmoke", () => {
+	it("execs npx from a temp directory, not the repo root", () => {
+		/** @type {{ cmd: string, args: string[], opts: { cwd?: string } }[]} */
+		const calls = [];
+		const written = [];
+
+		const result = runCreateLauncherSmoke({
+			createVersion: "0.0.1-dev.80",
+			tmpdir: () => "/tmp",
+			mkdtempSync: (prefix) => `${prefix}abc`,
+			writeFileSync: (path, body) => {
+				written.push({ path, body });
+			},
+			spawnSync: (cmd, args, opts) => {
+				calls.push({ cmd, args, opts });
+				return { status: 0 };
+			},
+			stdio: "pipe",
+		});
+
+		expect(result.workDir).toBe("/tmp/decohere-create-smoke-abc");
+		expect(result.workDir).not.toBe(process.cwd());
+		const npx = calls.at(-1);
+		expect(npx.cmd).toBe("npx");
+		expect(npx.args).toEqual(["--yes", "@decohere/create@0.0.1-dev.80", "--help"]);
+		expect(npx.opts.cwd).toBe("/tmp/decohere-create-smoke-abc");
+		expect(npx.opts.cwd).not.toBe(process.cwd());
+		expect(written).toEqual([
+			{
+				path: "/tmp/decohere-create-smoke-abc/.npmrc",
+				body: "@decohere:registry=https://registry.npmjs.org/\n",
+			},
+		]);
+		// The packages are public: the smoke installs them the way a user does, with no token.
+		expect(npx.opts.env.NODE_AUTH_TOKEN).toBeUndefined();
+	});
+
+	// npm's public cache can lag minutes behind a publish: the first token-free Publish ran npx
+	// 90 seconds after publishing and got ETARGET for a version the registry already had.
+	it("waits until npm serves the new version before running npx", () => {
+		/** @type {{ cmd: string, args: string[] }[]} */
+		const calls = [];
+		const sleeps = [];
+		let views = 0;
+
+		const result = runCreateLauncherSmoke({
+			createVersion: "0.0.1-dev.127",
+			tmpdir: () => "/tmp",
+			mkdtempSync: (prefix) => `${prefix}abc`,
+			writeFileSync: () => {},
+			spawnSync: (cmd, args) => {
+				calls.push({ cmd, args });
+				if (cmd === "npm") return { status: ++views < 3 ? 1 : 0 };
+				return { status: 0 };
+			},
+			sleep: (ms) => sleeps.push(ms),
+			stdio: "pipe",
+		});
+
+		expect(result.status).toBe(0);
+		expect(calls.map((call) => call.cmd)).toEqual(["npm", "npm", "npm", "npx"]);
+		expect(calls[0].args).toEqual(["view", "@decohere/create@0.0.1-dev.127", "version"]);
+		expect(sleeps).toHaveLength(2);
+	});
+
+	it("fails without running npx when npm never serves the version", () => {
+		/** @type {string[]} */
+		const commands = [];
+
+		const result = runCreateLauncherSmoke({
+			createVersion: "0.0.1-dev.127",
+			tmpdir: () => "/tmp",
+			mkdtempSync: (prefix) => `${prefix}abc`,
+			writeFileSync: () => {},
+			spawnSync: (cmd) => {
+				commands.push(cmd);
+				return { status: 1 };
+			},
+			sleep: () => {},
+			attempts: 3,
+			stdio: "pipe",
+		});
+
+		expect(result.status).toBe(1);
+		expect(commands).toEqual(["npm", "npm", "npm"]);
+	});
+
+	it("fails closed without a version", () => {
+		expect(() => runCreateLauncherSmoke({ createVersion: "" })).toThrow(
+			"CREATE_VERSION is required",
+		);
+	});
+});
+
+describe("publish.yml create smoke + tag", () => {
+	const yml = fs.readFileSync(PUBLISH_YML, "utf8");
+
+	it("wires create smoke through the isolated launcher", () => {
+		expect(yml).toContain("node projects/ci-tools/src/github/smoke-create-launcher.mjs");
+		expect(yml).toContain("CREATE_VERSION:");
+		expect(yml).not.toContain("npx --yes");
+	});
+
+	it("reads npm without a token: the packages are public and publishing is OIDC", () => {
+		const workflows = fileURLToPath(new URL("../../../../.github/", import.meta.url));
+		const files = fs
+			.readdirSync(workflows, { recursive: true })
+			.filter((file) => /\.ya?ml$/.test(file));
+		expect(files.length).toBeGreaterThan(0);
+		for (const file of files) {
+			expect(fs.readFileSync(`${workflows}${file}`, "utf8"), file).not.toMatch(
+				/NODE_AUTH_TOKEN|_authToken/,
+			);
+		}
+	});
+
+	it("grants the tag job actions:read so publish-prepare can download CI artifacts", () => {
+		const tag = yml.slice(yml.indexOf("\n  tag:"));
+		const perms = tag.slice(tag.indexOf("permissions:"), tag.indexOf("steps:"));
+		expect(perms).toMatch(/contents:\s*write/);
+		expect(perms).toMatch(/actions:\s*read/);
+	});
+});

package/tests/lib/github-issue.test.mjs

@@ -0,0 +1,85 @@
+import { describe, expect, it } from "vitest";
+import { pickIssue, upsertIssue } from "../../src/lib/github-issue.mjs";
+
+const TITLE = "security(ci): high or critical npm audit findings";
+
+/** A fake `gh` that answers `issue list` with `issues` and records every call. */
+function fakeGh(issues) {
+	/** @type {{ args: string[], input?: string }[]} */
+	const calls = [];
+	const run = (args, input) => {
+		calls.push({ args, input });
+		if (args[1] === "list") return JSON.stringify(issues);
+		if (args[1] === "create") return "https://github.com/typesmiths/decohere/issues/42\n";
+		return "";
+	};
+	return { run, calls };
+}
+
+describe("github-issue", () => {
+	it("matches the exact title only and prefers an open issue", () => {
+		const issues = [
+			{ number: 1, title: TITLE, state: "CLOSED", url: "u1" },
+			{ number: 2, title: `${TITLE} (old)`, state: "OPEN", url: "u2" },
+			{ number: 3, title: TITLE, state: "OPEN", url: "u3" },
+		];
+		expect(pickIssue(issues, TITLE)?.number).toBe(3);
+		expect(pickIssue(issues.slice(0, 2), TITLE)?.number).toBe(1);
+		expect(pickIssue([], TITLE)).toBeNull();
+	});
+
+	// GitHub's search can't match `security(ci): …` unquoted, so the lookup found nothing
+	// and a new issue was opened on every run.
+	it("searches for the title as a quoted phrase", () => {
+		const { run, calls } = fakeGh([]);
+		upsertIssue({ title: "security(ci): npm audit vulnerabilities detected", body: "b" }, run);
+		const args = calls[0].args;
+		expect(args[args.indexOf("--search") + 1]).toBe(
+			'"security(ci): npm audit vulnerabilities detected" in:title',
+		);
+	});
+
+	it("opens an issue with assignees when none has the title", () => {
+		const { run, calls } = fakeGh([]);
+		const result = upsertIssue({ title: TITLE, body: "body", assignees: ["das974"] }, run);
+		expect(result).toEqual({
+			number: 42,
+			url: "https://github.com/typesmiths/decohere/issues/42",
+			created: true,
+		});
+		expect(calls[1]).toEqual({
+			args: [
+				"issue",
+				"create",
+				"--title",
+				TITLE,
+				"--body-file",
+				"-",
+				"--add-assignee",
+				"das974",
+			],
+			input: "body",
+		});
+	});
+
+	it("updates an open issue's body in place", () => {
+		const { run, calls } = fakeGh([{ number: 7, title: TITLE, state: "OPEN", url: "u7" }]);
+		const result = upsertIssue({ title: TITLE, body: "new body" }, run);
+		expect(result).toEqual({ number: 7, url: "u7", created: false });
+		expect(calls.map((call) => call.args[1])).toEqual(["list", "edit"]);
+		expect(calls[1]).toEqual({
+			args: ["issue", "edit", "7", "--body-file", "-"],
+			input: "new body",
+		});
+	});
+
+	it("reopens a closed issue before updating it", () => {
+		const { run, calls } = fakeGh([{ number: 7, title: TITLE, state: "CLOSED", url: "u7" }]);
+		upsertIssue({ title: TITLE, body: "b", repo: "typesmiths/decohere" }, run);
+		expect(calls.map((call) => call.args.slice(0, 3))).toEqual([
+			["issue", "list", "--repo"],
+			["issue", "reopen", "7"],
+			["issue", "edit", "7"],
+		]);
+	});
+});