@decohere/ci-tools 0.0.1-dev.19 → 0.0.1-dev.20261105.46

package/src/release/npm-links.mjs

@@ -4,8 +4,9 @@
  * Outputs markdown formatted links for GitHub release notes
  */
 
-import { readdirSync, readFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { listProjectDirs } from "../lib/workspace-packages.mjs";
 
 const VERSION = process.argv[2] || process.env.VERSION;
 
@@ -15,20 +16,12 @@ if (!VERSION) {
 }
 
 let links = "## Published Packages\n\n";
-const projectsDir = join(process.cwd(), "projects");
 
 try {
-	const projects = readdirSync(projectsDir);
-
-	for (const project of projects) {
-		const pkgPath = join(projectsDir, project, "package.json");
-		try {
-			const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-			if (pkg.name?.startsWith("@decohere/")) {
-				links += `- [\`${pkg.name}@${VERSION}\`](https://www.npmjs.com/package/${pkg.name}/v/${VERSION})\n`;
-			}
-		} catch {
-			// Skip projects without package.json
+	for (const projectDir of listProjectDirs(process.cwd())) {
+		const pkg = JSON.parse(readFileSync(join(projectDir, "package.json"), "utf8"));
+		if (pkg.name?.startsWith("@decohere/")) {
+			links += `- [\`${pkg.name}@${VERSION}\`](https://www.npmjs.com/package/${pkg.name}/v/${VERSION})\n`;
 		}
 	}
 

package/src/release/sync-dependencies.mjs

@@ -7,10 +7,9 @@
 import { execSync } from "node:child_process";
 
 const DRY_RUN = process.env.DRY_RUN === "true";
-const TERMINAL_CLI = process.env.TERMINAL_CLI || "dist/debug/projects/terminal/src/cli.js";
 const DECOHERE_CONFIG = process.env.DECOHERE_CONFIG || ".decohere.js";
 
-const baseCmd = `node "${TERMINAL_CLI}" --log-level trace --config-file "${DECOHERE_CONFIG}" forge dependencies --configuration release sync`;
+const baseCmd = `pnpm forge --log-level info --config-file "${DECOHERE_CONFIG}" dependencies --configuration release sync`;
 
 try {
 	if (DRY_RUN) {

package/tests/audit/format.test.mjs

@@ -0,0 +1,115 @@
+import { describe, expect, it } from "vitest";
+import {
+	formatLog,
+	formatMarkdown,
+	highCritical,
+	parseAudit,
+} from "../../src/audit/format.mjs";
+
+const fixture = {
+	metadata: {
+		vulnerabilities: { info: 0, low: 1, moderate: 0, high: 1, critical: 0, total: 2 },
+	},
+	advisories: {
+		1: {
+			id: 1,
+			module_name: "nanoid",
+			severity: "high",
+			title: "nanoid: custom generators can loop indefinitely when size is zero",
+			url: "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
+			vulnerable_versions: "<3.3.18",
+			patched_versions: ">=3.3.18",
+			cves: [],
+			findings: [{ version: "3.3.17", paths: [". > vite > postcss > nanoid@3.3.17"] }],
+		},
+		2: {
+			id: 2,
+			module_name: "esbuild",
+			severity: "low",
+			title: "esbuild Windows file read",
+			url: "https://github.com/advisories/GHSA-g7r4-m6w7-qqqr",
+			vulnerable_versions: "<0.28.1",
+			patched_versions: ">=0.28.1",
+			cves: [],
+			findings: [{ version: "0.27.3", paths: [". > vite > esbuild"] }],
+		},
+	},
+};
+
+describe("parseAudit", () => {
+	it("reads severity counts and sorts advisories critical/high first", () => {
+		const parsed = parseAudit(fixture);
+		expect(parsed.total).toBe(2);
+		expect(parsed.high).toBe(1);
+		expect(parsed.low).toBe(1);
+		expect(parsed.advisories.map((a) => a.module)).toEqual(["nanoid", "esbuild"]);
+		expect(parsed.advisories[0]?.severity).toBe("high");
+		expect(parsed.advisories[0]?.ghsa).toBe("GHSA-2v37-7h3g-55p8");
+	});
+});
+
+describe("formatLog", () => {
+	it("prints severity counts and advisory lines including GHSA", () => {
+		const log = formatLog(parseAudit(fixture));
+		expect(log).toContain("high=1");
+		expect(log).toContain("[high] nanoid GHSA-2v37-7h3g-55p8");
+		expect(log).toContain("[low] esbuild");
+	});
+});
+
+describe("formatMarkdown", () => {
+	it("includes a severity table and linked advisories", () => {
+		const md = formatMarkdown(parseAudit(fixture));
+		expect(md).toContain("| High | 1 |");
+		expect(md).toContain("**high** `nanoid`");
+		expect(md).toContain("GHSA-2v37-7h3g-55p8");
+	});
+});
+
+describe("highCritical", () => {
+	it("filters to high and critical only", () => {
+		expect(highCritical(parseAudit(fixture)).map((a) => a.module)).toEqual(["nanoid"]);
+	});
+});
+
+describe("parseAudit npm v2", () => {
+	it("dedupes GHSA rows from package via objects", () => {
+		const v2 = {
+			auditReportVersion: 2,
+			metadata: {
+				vulnerabilities: { info: 0, low: 0, moderate: 0, high: 1, critical: 0, total: 1 },
+			},
+			vulnerabilities: {
+				nanoid: {
+					name: "nanoid",
+					severity: "high",
+					via: [
+						{
+							source: 1103848,
+							name: "nanoid",
+							title: "nanoid infinite loop",
+							url: "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
+							severity: "high",
+							range: "<3.3.18",
+						},
+					],
+					range: "<3.3.18",
+					nodes: ["node_modules/.pnpm/nanoid@3.3.17/node_modules/nanoid"],
+				},
+				postcss: {
+					name: "postcss",
+					severity: "high",
+					via: ["nanoid"],
+					effects: [],
+					range: "*",
+					nodes: ["node_modules/.pnpm/postcss@8.5.26/node_modules/postcss"],
+				},
+			},
+		};
+		const parsed = parseAudit(v2);
+		expect(parsed.advisories).toHaveLength(1);
+		expect(parsed.advisories[0]?.module).toBe("nanoid");
+		expect(parsed.advisories[0]?.ghsa).toBe("GHSA-2v37-7h3g-55p8");
+		expect(parsed.advisories[0]?.vulnerable).toBe("<3.3.18");
+	});
+});

package/tests/bench/history.test.mjs

@@ -0,0 +1,279 @@
+import { describe, expect, it } from "vitest";
+import {
+	appendRun,
+	assertValid,
+	compare,
+	contextId,
+	compareRounds,
+	latestRun,
+	pruneStale,
+	formatComparison,
+	fromVitest,
+	getContext,
+	normalize,
+	parseResults,
+	previousRun,
+	RESULT_PREFIX,
+} from "../../src/bench/history.mjs";
+
+const fakeOs = {
+	cpus: () => [{ model: " Test CPU " }, { model: "Test CPU" }],
+	platform: () => "linux",
+	arch: () => "x64",
+	totalmem: () => 16 * 1024 ** 3,
+};
+const ctx = getContext(
+	fakeOs,
+	{ BENCH_ENV: "gh-actions" },
+	"v24.1.0",
+	new Date("2026-10-20T03:17:00Z"),
+);
+
+const result = (id, median, extra = {}) => ({
+	id,
+	label: id,
+	unit: "ms",
+	median,
+	p90: median * 1.2,
+	min: median * 0.9,
+	max: median * 1.3,
+	samples: 5,
+	...extra,
+});
+
+const vitestOutput = {
+	files: [
+		{
+			groups: [
+				{
+					benchmarks: [
+						{
+							name: "forge build es6 + types (18 files)",
+							mean: 70,
+							median: 64,
+							min: 60,
+							max: 80,
+							sampleCount: 5,
+						},
+						{
+							name: "forge build es6 only (18 files)",
+							mean: 10,
+							min: 8,
+							max: 12,
+							sampleCount: 5,
+						},
+					],
+				},
+			],
+		},
+	],
+};
+
+describe("getContext / contextId", () => {
+	it("describes the machine and names the CI environment with the Node major", () => {
+		expect(ctx).toEqual({
+			benchEnv: "gh-actions-node24",
+			date: "2026-10-20T03:17:00.000Z",
+			os: { platform: "linux", arch: "x64" },
+			cpu: { model: "Test CPU", count: 2 },
+			memoryGb: 16,
+			node: "v24.1.0",
+		});
+		expect(getContext(fakeOs, {}, "v24.1.0").benchEnv).toBe("(local)");
+	});
+
+	it("gives the same id to the same machine regardless of date or env label", () => {
+		const later = getContext(fakeOs, {}, "v24.1.0", new Date("2027-01-01"));
+		expect(contextId(later)).toBe(contextId(ctx));
+		expect(contextId({ ...ctx, cpu: { ...ctx.cpu, count: 4 } })).not.toBe(contextId(ctx));
+	});
+});
+
+describe("parseResults", () => {
+	it("reads the last result line among other output", () => {
+		const results = [result("flux.load.cold", 250)];
+		const output = `flux load: median 250 ms\n${RESULT_PREFIX}[]\n${RESULT_PREFIX}${JSON.stringify(results)}\n`;
+		expect(parseResults(output, "flux-load")).toEqual(results);
+	});
+
+	it("fails, naming the suite, when there is no result line", () => {
+		expect(() => parseResults("crashed\n", "flux-serve")).toThrow(/flux-serve/);
+	});
+});
+
+describe("fromVitest", () => {
+	it("maps forge benchmarks to stable ids, keeping the file count out of the label", () => {
+		expect(fromVitest(vitestOutput)).toEqual([
+			{
+				id: "forge.build.local",
+				label: "forge build es6 + types",
+				unit: "ms",
+				median: 64,
+				min: 60,
+				max: 80,
+				samples: 5,
+				files: 18,
+			},
+			// No median from vitest: the mean stands in.
+			expect.objectContaining({ id: "forge.build.debug", median: 10, files: 18 }),
+		]);
+	});
+
+	it("fails on a benchmark it has no id for, instead of charting it under a moving name", () => {
+		const output = {
+			files: [{ groups: [{ benchmarks: [{ name: "something new", mean: 1 }] }] }],
+		};
+		expect(() => fromVitest(output)).toThrow(/something new/);
+	});
+});
+
+describe("assertValid", () => {
+	it("passes real results and rejects NaN or empty ones, naming them", () => {
+		expect(() => assertValid([result("a", 1)])).not.toThrow();
+		expect(() =>
+			assertValid([result("a", 1), result("b", Number.NaN), result("c", 2, { samples: 0 })]),
+		).toThrow(/b, c/);
+	});
+});
+
+describe("normalize", () => {
+	it("keeps a version 2 history as it is", () => {
+		const history = { version: 2, contexts: { x: { context: ctx, runs: [] } } };
+		expect(normalize(history)).toBe(history);
+	});
+
+	it("converts version 1 forge runs so their trend carries on", () => {
+		const v1 = {
+			runs: {
+				abc: {
+					context: ctx,
+					runs: [{ date: "2026-08-12T14:18:10Z", context: ctx, vitestOutput }],
+				},
+				empty: { context: ctx, runs: [] },
+			},
+		};
+		const history = normalize(v1);
+		expect(Object.keys(history.contexts)).toEqual(["abc"]);
+		expect(history.contexts.abc.runs[0]).toMatchObject({
+			date: "2026-08-12T14:18:10Z",
+			sha: null,
+			results: [{ id: "forge.build.local" }, { id: "forge.build.debug" }],
+		});
+	});
+
+	it("starts empty when there is no history", () => {
+		expect(normalize(null)).toEqual({ version: 2, contexts: {} });
+	});
+});
+
+describe("appendRun / previousRun", () => {
+	const run = (day) => ({
+		date: `2026-10-${day}T03:17:00Z`,
+		sha: `sha${day}`,
+		results: [result("a", Number(day))],
+	});
+
+	it("puts the new run first, trims to the limit, and leaves the input untouched", () => {
+		const empty = normalize(null);
+		const one = appendRun(empty, ctx, run("18"), 2);
+		const two = appendRun(one, ctx, run("19"), 2);
+		const three = appendRun(two, ctx, run("20"), 2);
+
+		expect(empty.contexts).toEqual({});
+		expect(one.contexts[contextId(ctx)].runs).toHaveLength(1);
+		expect(three.contexts[contextId(ctx)].runs.map((r) => r.sha)).toEqual(["sha20", "sha19"]);
+		expect(previousRun(three, contextId(ctx))?.sha).toBe("sha20");
+		expect(previousRun(three, "other-machine")).toBeUndefined();
+	});
+});
+
+describe("compare / formatComparison", () => {
+	it("reports the change in median against the previous run, and n/a for new benchmarks", () => {
+		const rows = compare([result("a", 120), result("new", 5)], {
+			results: [result("a", 100)],
+		});
+		expect(rows).toEqual([
+			{ id: "a", current: 120, previous: 100, delta: 20, percent: 20 },
+			{ id: "new", current: 5 },
+		]);
+
+		const table = formatComparison(rows).split("\n");
+		expect(table[0]).toMatch(/^Benchmark \| +Median \| Previous \| +Delta \| +%$/);
+		expect(table[2]).toMatch(/^a +\| +120\.0 ms \| +100\.0 ms \| +\+20\.0 ms \| \+20\.0%$/);
+		expect(table[3]).toMatch(/^new +\| +5\.0 ms \| +n\/a \| +n\/a \| +n\/a$/);
+	});
+
+	it("compares against nothing on a machine's first run", () => {
+		expect(compare([result("a", 1)], undefined)).toEqual([{ id: "a", current: 1 }]);
+	});
+});
+
+describe("compareRounds", () => {
+	const round = (...medians) => medians.map((median, index) => result(`b${index}`, median));
+
+	it("flags a benchmark slower on head than base in every round, with both rounds' numbers", () => {
+		const [regression] = compareRounds([round(130, 50)], [round(100, 50)], {
+			threshold: 0.2,
+			rounds: 1,
+		});
+		expect(regression).toMatchObject({
+			id: "b0",
+			base: 100,
+			head: 130,
+			rounds: [{ base: 100, head: 130 }],
+		});
+		expect(regression.percent).toBeCloseTo(30);
+	});
+
+	it("needs every round slower: one slow round is as likely the runner as the code", () => {
+		expect(compareRounds([round(130), round(105)], [round(100), round(100)])).toEqual([]);
+		expect(compareRounds([round(130), round(126)], [round(100), round(100)])).toHaveLength(1);
+	});
+
+	it("ignores slowdowns within the threshold", () => {
+		expect(compareRounds([round(115), round(118)], [round(100), round(100)])).toEqual([]);
+	});
+
+	it("skips benchmarks only one side has, and compares nothing without enough rounds", () => {
+		const head = [
+			[result("new", 500), result("old", 100)],
+			[result("new", 500), result("old", 100)],
+		];
+		const base = [[result("old", 100)], [result("old", 100)]];
+		expect(compareRounds(head, base)).toEqual([]);
+		expect(compareRounds([round(200)], [round(100)])).toEqual([]);
+	});
+});
+
+describe("pruneStale / latestRun", () => {
+	const at = (date, sha) => ({ date, sha, results: [] });
+	const history = {
+		version: 2,
+		contexts: {
+			old: { context: ctx, runs: [at("2026-08-12T03:17:00Z", "aaa")] },
+			recent: {
+				context: ctx,
+				runs: [at("2026-10-20T03:17:00Z", "ccc"), at("2026-10-19T03:17:00Z", "bbb")],
+			},
+		},
+	};
+
+	it("drops machine types with no run in the last 30 days", () => {
+		expect(
+			Object.keys(pruneStale(history, new Date("2026-10-21T00:00:00Z")).contexts),
+		).toEqual(["recent"]);
+		expect(
+			Object.keys(pruneStale(history, new Date("2026-09-01T00:00:00Z")).contexts),
+		).toEqual(["old", "recent"]);
+	});
+
+	it("prunes when a run is appended", () => {
+		const next = appendRun(history, ctx, at("2026-10-21T03:17:00Z", "ddd"));
+		expect(Object.keys(next.contexts)).not.toContain("old");
+	});
+
+	it("finds the newest run on any machine: the commit the previous nightly measured", () => {
+		expect(latestRun(history)?.sha).toBe("ccc");
+		expect(latestRun({ version: 2, contexts: {} })).toBeUndefined();
+	});
+});

package/tests/bench/regression-issue.test.mjs

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "vitest";
+import { issueBody, issueTitle } from "../../src/bench/regression-issue.mjs";
+
+const regression = {
+	id: "flux.load.cold",
+	label: "flux load, first import (cold process)",
+	base: 300,
+	head: 400,
+	percent: 33.3,
+	rounds: [
+		{ base: 300, head: 395 },
+		{ base: 300, head: 405 },
+	],
+};
+const context = {
+	repoUrl: "https://github.com/typesmiths/decohere",
+	runUrl: "https://github.com/typesmiths/decohere/actions/runs/1",
+	machine: "gh-actions-node24, Test CPU × 4",
+	threshold: 0.2,
+	base: "aaaaaaaaaaaaaaaa",
+	head: "cccccccccccccccc",
+};
+
+describe("regression issue", () => {
+	it("has one stable title per benchmark, so the nightly run finds and updates it", () => {
+		expect(issueTitle(regression)).toBe("perf(bench): flux.load.cold is slower");
+	});
+
+	it("gives both rounds, the commit range and how to reproduce", () => {
+		const body = issueBody(regression, context);
+		expect(body).toContain(
+			"is 33% slower on [`ccccccc`](https://github.com/typesmiths/decohere/commit/cccccccccccccccc)",
+		);
+		expect(body).toContain("| 1 | 300.0 ms | 395.0 ms |");
+		expect(body).toContain("| 2 | 300.0 ms | 405.0 ms |");
+		expect(body).toContain(
+			"(https://github.com/typesmiths/decohere/compare/aaaaaaaaaaaaaaaa...cccccccccccccccc)",
+		);
+		expect(body).toContain("check out `aaaaaaa`, run `pnpm bench:save`");
+		expect(body).toContain(context.runUrl);
+	});
+});

package/tests/github/ci-workflow.test.mjs

@@ -0,0 +1,19 @@
+import { fileURLToPath } from "node:url";
+import { describe, expect, it, vi } from "vitest";
+
+const fs = await vi.importActual("node:fs");
+const CI_YML = fileURLToPath(new URL("../../../../.github/workflows/ci.yml", import.meta.url));
+
+describe("ci.yml and the merge queue", () => {
+	const yml = fs.readFileSync(CI_YML, "utf8");
+	const triggers = yml.slice(yml.indexOf("\non:"), yml.indexOf("\nconcurrency:"));
+	const gate = yml.slice(yml.indexOf("- id: gate"), yml.indexOf("# Static gates"));
+
+	it("runs for queued pull requests, or the queue waits forever for the required check", () => {
+		expect(triggers).toMatch(/^\s+merge_group:/m);
+	});
+
+	it("runs the whole suite in the queue: the docs-only shortcut is only for pull requests", () => {
+		expect(gate).toContain('"${{ github.event_name }}" == "merge_group"');
+	});
+});

package/tests/github/npm-bootstrap.test.mjs

@@ -0,0 +1,125 @@
+import { vol } from "memfs";
+import { afterEach, describe, expect, it } from "vitest";
+import { runBootstrap } from "../../src/github/npm-bootstrap.mjs";
+
+const root = "/workspace";
+
+function seedWorkspace() {
+	vol.fromJSON({
+		[`${root}/package.json`]: JSON.stringify({ version: "0.0.1-dev.5" }),
+		[`${root}/projects/scribe/scribe/package.json`]: JSON.stringify({
+			name: "@decohere/scribe",
+			version: "0.0.1-dev.5",
+		}),
+		[`${root}/projects/scribe/scribe-console/package.json`]: JSON.stringify({
+			name: "@decohere/scribe-console",
+			version: "0.0.1-dev.5",
+		}),
+	});
+}
+
+/**
+ * A fake registry: `published` names exist, and `trusted` names have a Trusted
+ * Publisher. Each call is recorded as its arguments, plus the code npm would
+ * get through NPM_CONFIG_OTP.
+ */
+function fakeNpm({ published = [], trusted = [], loggedIn = true } = {}) {
+	const calls = [];
+	const npm = (args, { otp } = {}) => {
+		calls.push(`${args.join(" ")}${otp ? ` [otp ${otp}]` : ""}`);
+		if (args[0] === "whoami") {
+			return { status: loggedIn ? 0 : 1, output: "" };
+		}
+		if (args[0] === "trust" && args[1] === "list") {
+			return trusted.includes(args[2])
+				? { status: 0, output: '[{"repository":"typesmiths/decohere","file":"publish.yml"}]' }
+				: { status: 0, output: "[]" };
+		}
+		return { status: 0, output: "" };
+	};
+	return { npm, calls, nameExists: (name) => published.includes(name) };
+}
+
+function run(argv, registry) {
+	const lines = [];
+	return runBootstrap({
+		argv,
+		root,
+		io: {
+			npm: registry.npm,
+			nameExists: registry.nameExists,
+			log: (line) => lines.push(line),
+		},
+	}).then((code) => ({ code, lines }));
+}
+
+afterEach(() => {
+	vol.reset();
+});
+
+describe("npm-bootstrap", () => {
+	it("first-publishes unpublished names public, then sets the Trusted Publisher", async () => {
+		seedWorkspace();
+		const registry = fakeNpm({ published: ["@decohere/scribe"] });
+
+		const { code } = await run(["--otp", "123456"], registry);
+
+		expect(code).toBe(0);
+		expect(registry.calls).toEqual([
+			"whoami",
+			"publish ./projects/scribe/scribe-console --access public --tag dev [otp 123456]",
+			"trust list @decohere/scribe-console --json [otp 123456]",
+			"trust github @decohere/scribe-console --file publish.yml --repo typesmiths/decohere --env npm-publish --allow-publish --yes [otp 123456]",
+		]);
+	});
+
+	it("skips the steps that are already done", async () => {
+		seedWorkspace();
+		const registry = fakeNpm({
+			published: ["@decohere/scribe-console"],
+			trusted: ["@decohere/scribe-console"],
+		});
+
+		const { code } = await run(["@decohere/scribe-console"], registry);
+
+		expect(code).toBe(0);
+		expect(registry.calls).toEqual(["whoami", "trust list @decohere/scribe-console --json"]);
+	});
+
+	/** `npm trust` rejects `--otp`: the code goes through the environment. */
+	it("never passes the code as an argument, and lets npm ask when none is given", async () => {
+		seedWorkspace();
+		const withCode = fakeNpm({ published: ["@decohere/scribe"] });
+		await run(["--otp", "604381"], withCode);
+		expect(withCode.calls.join("\n")).not.toContain("--otp");
+
+		const withoutCode = fakeNpm({ published: ["@decohere/scribe"] });
+		expect((await run([], withoutCode)).code).toBe(0);
+		expect(withoutCode.calls.join("\n")).not.toContain("otp");
+	});
+
+	it("prints the commands on a dry run, calling npm only to check the login", async () => {
+		seedWorkspace();
+		const registry = fakeNpm({ published: ["@decohere/scribe"] });
+
+		const { code, lines } = await run(["--dry-run"], registry);
+
+		expect(code).toBe(0);
+		expect(registry.calls).toEqual(["whoami"]);
+		expect(lines).toContain(
+			"[dry run] npm publish ./projects/scribe/scribe-console --access public --tag dev",
+		);
+	});
+
+	it("stops when not logged in, or for a name that is not a package", async () => {
+		seedWorkspace();
+		const loggedOut = fakeNpm({ loggedIn: false });
+		expect((await run(["--otp", "1"], loggedOut)).code).toBe(1);
+		expect(loggedOut.calls).toEqual(["whoami"]);
+
+		const typo = fakeNpm();
+		const { code, lines } = await run(["@decohere/scribe-consol"], typo);
+		expect(code).toBe(1);
+		expect(lines).toEqual(["Not a publishable package in projects/: @decohere/scribe-consol"]);
+	});
+});