@flytedesk/app-kit 0.3.0 → 0.4.0

package/scripts/release.test.ts

@@ -0,0 +1,205 @@
+import { describe, expect, it, beforeAll } from "vitest";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+// scripts/release.sh refuses to do anything except from the sanctioned
+// deploy clone, with a clean tree, without a live lock, and only for a
+// commit reachable from origin/main. Those guards run before npm ci / the
+// gates, so they're cheap and fully testable against throwaway git repos
+// (no Docker, no network, no real npm publish).
+
+const SCRIPT_PATH = resolve(__dirname, "release.sh");
+
+// On Windows, a bare `bash` on PATH can resolve to the WSL launcher in
+// System32 instead of Git Bash, which can't reliably run against a
+// C:/Users/... working tree. Find Git Bash explicitly when it exists;
+// fall back to `bash` (e.g. on Linux CI, where `bash` is unambiguous).
+function resolveBash(): string {
+  const candidates = [
+    "C:\\Program Files\\Git\\bin\\bash.exe",
+    "C:\\Program Files\\Git\\usr\\bin\\bash.exe",
+  ];
+  for (const c of candidates) {
+    if (existsSync(c)) return c;
+  }
+  return "bash";
+}
+
+const BASH = resolveBash();
+
+function run(cwd: string, args: string[] = []) {
+  const result = spawnSync(BASH, [SCRIPT_PATH, ...args], {
+    cwd,
+    encoding: "utf8",
+    env: { ...process.env },
+  });
+  return result;
+}
+
+function git(cwd: string, args: string[]) {
+  const result = spawnSync("git", args, { cwd, encoding: "utf8" });
+  if (result.status !== 0) {
+    throw new Error(
+      `git ${args.join(" ")} failed in ${cwd}: ${result.stderr}${result.stdout}`,
+    );
+  }
+  return result.stdout;
+}
+
+function initRepoWithCommit(dir: string) {
+  git(dir, ["init", "-q", "-b", "main"]);
+  git(dir, ["config", "user.email", "test@example.com"]);
+  git(dir, ["config", "user.name", "Test"]);
+  // Ignore the script's own local-only marker/lock files so creating them
+  // doesn't itself count as "dirty" in these throwaway repos.
+  writeFileSync(join(dir, ".gitignore"), ".deploy-clone-marker\n.release.lock\n");
+  writeFileSync(join(dir, "README.md"), "test repo\n");
+  git(dir, ["add", "."]);
+  git(dir, ["commit", "-q", "-m", "initial commit"]);
+}
+
+function addMarker(dir: string) {
+  writeFileSync(join(dir, ".deploy-clone-marker"), "test marker\n");
+}
+
+describe("scripts/release.sh guards", () => {
+  let workDir: string;
+
+  beforeAll(() => {
+    workDir = mkdtempSync(join(tmpdir(), "release-sh-test-"));
+  });
+
+  it("refuses to run outside the deploy clone (no marker file)", () => {
+    const dir = mkdtempSync(join(workDir, "no-marker-"));
+    initRepoWithCommit(dir);
+    // deliberately no .deploy-clone-marker
+
+    const result = run(dir);
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toMatch(/not the sanctioned deploy clone/i);
+  });
+
+  it("refuses a dirty working tree even with the marker present", () => {
+    const dir = mkdtempSync(join(workDir, "dirty-"));
+    initRepoWithCommit(dir);
+    addMarker(dir);
+    // Make an uncommitted, non-ignored change.
+    writeFileSync(join(dir, "README.md"), "modified, uncommitted\n");
+
+    const result = run(dir);
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toMatch(/dirty/i);
+  });
+
+  it("refuses to run when the lock file is already held", () => {
+    const dir = mkdtempSync(join(workDir, "locked-"));
+    initRepoWithCommit(dir);
+    addMarker(dir);
+    writeFileSync(join(dir, ".release.lock"), "99999\n");
+
+    const result = run(dir);
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toMatch(/lock file .* already exists/i);
+    // The guard must not have deleted a lock file it didn't create itself
+    // (the trap only fires once *this* run successfully takes the lock).
+    expect(existsSync(join(dir, ".release.lock"))).toBe(true);
+    rmSync(join(dir, ".release.lock"));
+  });
+
+  it("refuses a target commit that is not reachable from origin/main", () => {
+    // A bare "origin" with just the initial commit on main.
+    const originDir = mkdtempSync(join(workDir, "origin-"));
+    git(originDir, ["init", "-q", "--bare", "-b", "main"]);
+
+    const seedDir = mkdtempSync(join(workDir, "seed-"));
+    initRepoWithCommit(seedDir);
+    git(seedDir, ["remote", "add", "origin", originDir]);
+    git(seedDir, ["push", "-q", "origin", "main"]);
+
+    // The deploy clone: clone of origin, plus a local commit on a throwaway
+    // branch that is never pushed, so it is not an ancestor of origin/main.
+    // main itself stays exactly at origin/main's tip, so the tree the
+    // guards see is clean.
+    const cloneDir = join(workDir, "clone-unreachable");
+    git(workDir, ["clone", "-q", originDir, cloneDir]);
+    addMarker(cloneDir);
+    git(cloneDir, ["checkout", "-q", "-b", "throwaway"]);
+    writeFileSync(join(cloneDir, "unmerged.txt"), "local-only change\n");
+    git(cloneDir, ["add", "unmerged.txt"]);
+    git(cloneDir, ["commit", "-q", "-m", "unmerged local commit"]);
+    const unmergedSha = git(cloneDir, ["rev-parse", "HEAD"]).trim();
+    git(cloneDir, ["checkout", "-q", "main"]);
+
+    const result = run(cloneDir, [unmergedSha]);
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toMatch(/not reachable from origin\/main/i);
+  });
+});
+
+// scripts/pending-release-count.mjs decides "version + publish" vs "no-op".
+// A release runs from a clone of main, so pending changesets are already on
+// origin/main. The first real release (AK-13, 2026-09-24) counted zero because
+// it asked `changeset status --since=origin/main`; these tests pin the fix by
+// reproducing that exact shape: changesets committed AND pushed.
+describe("scripts/pending-release-count.mjs", () => {
+  const COUNT_SCRIPT = resolve(__dirname, "pending-release-count.mjs");
+  let workDir: string;
+
+  beforeAll(() => {
+    workDir = mkdtempSync(join(tmpdir(), "pending-count-test-"));
+  });
+
+  function cloneOfPushedPackage(name: string, changesets: Record<string, string>) {
+    const originDir = mkdtempSync(join(workDir, `${name}-origin-`));
+    git(originDir, ["init", "-q", "--bare", "-b", "main"]);
+
+    const seedDir = mkdtempSync(join(workDir, `${name}-seed-`));
+    initRepoWithCommit(seedDir);
+    writeFileSync(
+      join(seedDir, "package.json"),
+      JSON.stringify({ name: "@test/pkg", version: "0.3.2" }, null, 2),
+    );
+    mkdirSync(join(seedDir, ".changeset"));
+    writeFileSync(
+      join(seedDir, ".changeset", "config.json"),
+      JSON.stringify({ changelog: false, commit: false, baseBranch: "main", access: "public" }),
+    );
+    for (const [file, body] of Object.entries(changesets)) {
+      writeFileSync(join(seedDir, ".changeset", file), body);
+    }
+    git(seedDir, ["add", "."]);
+    git(seedDir, ["commit", "-q", "-m", "package with changesets"]);
+    git(seedDir, ["remote", "add", "origin", originDir]);
+    git(seedDir, ["push", "-q", "origin", "main"]);
+
+    const cloneDir = join(workDir, `${name}-clone`);
+    git(workDir, ["clone", "-q", originDir, cloneDir]);
+    return cloneDir;
+  }
+
+  function count(cwd: string) {
+    const result = spawnSync(process.execPath, [COUNT_SCRIPT], { cwd, encoding: "utf8" });
+    if (result.status !== 0) throw new Error(result.stderr || result.stdout);
+    return result.stdout;
+  }
+
+  it("counts changesets that are already on origin/main", () => {
+    const clone = cloneOfPushedPackage("pending", {
+      "minor-feature.md": '---\n"@test/pkg": minor\n---\n\nA feature.\n',
+    });
+
+    expect(count(clone)).toBe("1");
+  });
+
+  it("reports zero when no changesets are pending", () => {
+    const clone = cloneOfPushedPackage("none", {});
+
+    expect(count(clone)).toBe("0");
+  });
+});