@lullabot/playwright-testing 0.1.0

package/src/github/a11y-summary.ts

@@ -0,0 +1,421 @@
+import * as fs from 'fs'
+import * as path from 'path'
+
+/** Annotation types that identify accessibility-relevant test data. */
+const A11Y_ANNOTATION_TYPES = new Set([
+  '@a11y',
+  'Accessibility',
+  'Baselined a11y violation',
+  'Stale a11y baseline entry',
+])
+
+/**
+ * Escape a string for use inside a GitHub Actions workflow-command message
+ * body (the text after `::`). Without this, a crafted value containing a
+ * newline or `%` sequence could forge additional workflow commands.
+ * See https://docs.github.com/en/actions/reference/workflow-commands-for-github-actions
+ */
+function escapeWorkflowCommand(value: string): string {
+  return String(value)
+    .replace(/%/g, '%25')
+    .replace(/\r/g, '%0D')
+    .replace(/\n/g, '%0A')
+}
+
+/**
+ * Escape a string for use inside a GitHub Actions workflow-command property
+ * value (e.g. `file=...`, `title=...`). Property values additionally require
+ * escaping of `:` and `,` on top of the message-body escapes.
+ */
+function escapeWorkflowCommandProperty(value: string): string {
+  return escapeWorkflowCommand(value)
+    .replace(/:/g, '%3A')
+    .replace(/,/g, '%2C')
+}
+
+/**
+ * Escape a string for use inside a Markdown table cell. Backslashes must be
+ * escaped first (they are Markdown's escape character), then pipes and
+ * newlines can be substituted safely.
+ */
+function escapeMarkdownTableCell(value: string): string {
+  return String(value)
+    .replace(/\\/g, '\\\\')
+    .replace(/\|/g, '\\|')
+    .replace(/\r?\n/g, ' ')
+}
+
+/**
+ * Escape a string for use inside a Markdown inline code span (backticks).
+ * A literal backtick would close the span early and let the remainder render
+ * as Markdown — wrap the value in double backticks and pad literal backticks
+ * with spaces, which is the standard CommonMark escape for code spans.
+ */
+function escapeMarkdownCodeSpan(value: string): string {
+  const s = String(value).replace(/\r?\n/g, ' ')
+  if (!s.includes('`')) return `\`${s}\``
+  return `\`\` ${s.replace(/``/g, '` `')} \`\``
+}
+
+/** A test that has accessibility-related annotations and/or attachments. */
+export interface A11yTestResult {
+  /** Test title path, e.g. "a11y > homepage has accessibility violations" */
+  title: string
+  /** Source file, e.g. "tests/a11y.spec.ts" */
+  file: string
+  /** Line number in the source file. */
+  line: number
+  /** Accessibility annotations from testInfo.annotations. */
+  annotations: Array<{ type: string; description?: string }>
+  /** Parsed WCAG scan violations (from a11y-wcag-scan-results attachment). */
+  violations: NormalizedViolation[]
+}
+
+interface NormalizedViolation {
+  rule: string
+  impact: string
+  description: string
+  helpUrl: string
+  targets: string[]
+}
+
+/** Parsed report with only accessibility-relevant data. */
+export interface A11yReport {
+  tests: A11yTestResult[]
+  totalViolations: number
+  totalBaselined: number
+  totalStale: number
+}
+
+/**
+ * Parse a Playwright JSON report and extract accessibility-related test data.
+ */
+export function parseA11yResults(reportPath: string): A11yReport {
+  if (!fs.existsSync(reportPath)) {
+    throw new Error(
+      `Playwright JSON report not found at ${reportPath}. ` +
+      'Ensure the Playwright JSON reporter is enabled.'
+    )
+  }
+
+  const report = JSON.parse(fs.readFileSync(reportPath, 'utf8'))
+  const tests: A11yTestResult[] = []
+  let totalViolations = 0
+  let totalBaselined = 0
+  let totalStale = 0
+
+  walkSuites(report.suites ?? [], '', tests)
+
+  for (const test of tests) {
+    for (const ann of test.annotations) {
+      if (ann.type === 'Baselined a11y violation') totalBaselined++
+      if (ann.type === 'Stale a11y baseline entry') totalStale++
+    }
+    totalViolations += test.violations.length
+  }
+
+  return { tests, totalViolations, totalBaselined, totalStale }
+}
+
+/**
+ * Collect annotations from both test and result levels. Playwright stores
+ * annotations declared at test definition time on `test.annotations`, and
+ * annotations added during execution (e.g. `testInfo.annotations.push()`)
+ * on `result.annotations`. checkAccessibility() uses the latter.
+ */
+function collectAnnotations(test: any, lastResult: any): any[] {
+  return [
+    ...(test.annotations ?? []),
+    ...(lastResult?.annotations ?? []),
+  ]
+}
+
+/** Read and parse the WCAG scan attachment, if present. */
+function parseWcagViolations(attachment: any): NormalizedViolation[] {
+  if (!attachment) return []
+  try {
+    const raw = attachment.body
+      ? Buffer.from(attachment.body, 'base64').toString('utf8')
+      : attachment.path
+        ? fs.readFileSync(attachment.path, 'utf8')
+        : null
+    if (!raw) return []
+    const json = JSON.parse(raw)
+    if (!json?.violations) return []
+    return json.violations.map((v: any) => ({
+      rule: v.id,
+      impact: v.impact ?? 'unknown',
+      description: v.description,
+      helpUrl: v.helpUrl,
+      targets: v.nodes
+        ?.flatMap((n: any) => n.target)
+        .filter((t: any) => typeof t === 'string') ?? [],
+    }))
+  } catch {
+    // Parse errors are non-fatal — we'll just report without violation details.
+    return []
+  }
+}
+
+/** Extract an A11yTestResult from a Playwright test, or null if not a11y-related. */
+function extractTestResult(spec: any, test: any, file: string): A11yTestResult | null {
+  const lastResult = test.results?.[test.results.length - 1]
+  const attachments = lastResult?.attachments ?? []
+
+  const a11yAnnotations = collectAnnotations(test, lastResult)
+    .filter((a: any) => A11Y_ANNOTATION_TYPES.has(a.type))
+
+  if (a11yAnnotations.length === 0) return null
+
+  const violations = parseWcagViolations(
+    attachments.find((a: any) => a.name === 'a11y-wcag-scan-results'),
+  )
+
+  return {
+    title: spec.title,
+    file,
+    line: spec.line ?? 1,
+    annotations: a11yAnnotations,
+    violations,
+  }
+}
+
+function walkSuites(
+  suites: any[],
+  parentFile: string,
+  out: A11yTestResult[],
+) {
+  for (const suite of suites) {
+    const file = suite.file || parentFile
+
+    for (const spec of suite.specs ?? []) {
+      for (const test of spec.tests ?? []) {
+        const result = extractTestResult(spec, test, file)
+        if (result) out.push(result)
+      }
+    }
+
+    if (suite.suites) {
+      walkSuites(suite.suites, file, out)
+    }
+  }
+}
+
+/** Headline with pass/fail counts. */
+function renderHeadline(report: A11yReport): string {
+  const hasViolations = report.totalViolations > 0
+  const hasBaselined = report.totalBaselined > 0
+  const hasStale = report.totalStale > 0
+
+  if (!hasViolations && !hasBaselined && !hasStale) {
+    return ':white_check_mark: All accessibility checks passed.\n'
+  }
+
+  const parts: string[] = []
+  if (hasViolations) parts.push(`**${report.totalViolations}** violation(s)`)
+  if (hasBaselined) parts.push(`**${report.totalBaselined}** baselined`)
+  if (hasStale) parts.push(`**${report.totalStale}** stale baseline entries`)
+  return parts.join(' · ') + '\n'
+}
+
+/** Icon for an `Accessibility` annotation based on its violation count. */
+function iconForAccessibilityAnnotation(description: string): string {
+  // Descriptions look like "WCAG scan: 0 violations ..." or "WCAG scan: 3 violations ...".
+  const colonIdx = description.lastIndexOf(': ')
+  const afterColon = colonIdx >= 0 ? description.substring(colonIdx + 2) : description
+  const violationCount = parseInt(afterColon, 10)
+  return violationCount > 0 ? ':x:' : ':white_check_mark:'
+}
+
+function iconForAnnotation(ann: { type: string; description?: string }): string {
+  switch (ann.type) {
+    case 'Baselined a11y violation':
+      return ':white_check_mark:'
+    case 'Stale a11y baseline entry':
+      return ':warning:'
+    case 'Accessibility':
+      return iconForAccessibilityAnnotation(ann.description ?? '')
+    default:
+      return ':information_source:'
+  }
+}
+
+/** Render annotation lines, deduplicated by type+description. */
+function renderAnnotations(
+  annotations: Array<{ type: string; description?: string }>,
+): string[] {
+  const lines: string[] = []
+  const seen = new Set<string>()
+  for (const ann of annotations) {
+    const key = `${ann.type}:${ann.description ?? ''}`
+    if (seen.has(key)) continue
+    seen.add(key)
+    lines.push(`${iconForAnnotation(ann)} **${ann.type}**: ${ann.description ?? ''}\n`)
+  }
+  return lines
+}
+
+/** Render the violation table for a single test. */
+function renderViolationTable(violations: NormalizedViolation[]): string[] {
+  if (violations.length === 0) return []
+  const lines: string[] = [
+    '| Rule | Impact | Description | Targets |',
+    '|------|--------|-------------|---------|',
+  ]
+  for (const v of violations) {
+    const shown = v.targets.slice(0, 3).map(escapeMarkdownCodeSpan).join(', ')
+    const targets = v.targets.length > 3
+      ? `${shown}, +${v.targets.length - 3} more`
+      : shown
+    const rule = escapeMarkdownTableCell(v.rule)
+    const impact = escapeMarkdownTableCell(v.impact)
+    const description = escapeMarkdownTableCell(v.description)
+    lines.push(`| [${rule}](${v.helpUrl}) | ${impact} | ${description} | ${targets} |`)
+  }
+  lines.push('')
+  return lines
+}
+
+/**
+ * Generate Markdown for $GITHUB_STEP_SUMMARY.
+ */
+export function generateSummary(report: A11yReport): string {
+  if (report.tests.length === 0) {
+    return '## Accessibility Results\n\nNo accessibility tests were found in the report.\n'
+  }
+
+  const lines: string[] = ['## Accessibility Results\n', renderHeadline(report)]
+  const seenTitles = new Set<string>()
+
+  for (const test of report.tests) {
+    const testAnnotations = test.annotations.filter(a => a.type !== '@a11y')
+    const hasTestViolations = test.violations.length > 0
+    if (testAnnotations.length === 0 && !hasTestViolations) continue
+
+    // Skip duplicate test titles (different browsers report the same spec).
+    if (seenTitles.has(test.title)) continue
+    seenTitles.add(test.title)
+
+    const testLines: string[] = [`### ${test.title}\n`]
+    testLines.push(...renderAnnotations(testAnnotations))
+    testLines.push(...renderViolationTable(test.violations))
+
+    lines.push(...testLines)
+  }
+
+  return lines.join('\n')
+}
+
+/**
+ * Generate GitHub Actions annotation commands (::error, ::warning).
+ *
+ * All interpolated values are escaped — CSS selectors from axe-core targets
+ * are extracted from page DOM and could contain newlines or `%` sequences
+ * that would otherwise let a crafted page forge additional workflow commands.
+ */
+export function generateAnnotations(report: A11yReport): string {
+  const lines: string[] = []
+
+  for (const test of report.tests) {
+    const file = escapeWorkflowCommandProperty(test.file)
+    const line = escapeWorkflowCommandProperty(String(test.line))
+
+    // Emit ::error for each violation.
+    for (const v of test.violations) {
+      const targets = v.targets.slice(0, 3).join(', ')
+      const title = escapeWorkflowCommandProperty(`${v.rule} (${v.impact})`)
+      const msg = escapeWorkflowCommand(
+        `a11y: ${v.rule} (${v.impact}) — ${v.description}. Targets: ${targets}`,
+      )
+      lines.push(`::error file=${file},line=${line},title=${title}::${msg}`)
+    }
+
+    // Emit ::warning for stale baseline entries.
+    for (const ann of test.annotations) {
+      if (ann.type === 'Stale a11y baseline entry') {
+        const title = escapeWorkflowCommandProperty('Stale a11y baseline')
+        const msg = escapeWorkflowCommand(ann.description ?? '')
+        lines.push(`::warning file=${file},line=${line},title=${title}::${msg}`)
+      }
+    }
+  }
+
+  return lines.join('\n')
+}
+
+/**
+ * CLI entry point. Called automatically when this file is run directly
+ * (e.g. `node lib/github/a11y-summary.js`), or can be imported and
+ * called from the bin wrapper.
+ */
+export function main(
+  args: string[] = process.argv.slice(2),
+  adapter: { commandName?: string } = {},
+): void {
+  if (args.includes('--help') || args.includes('-h')) {
+    process.stdout.write(
+      `Usage: ${adapter.commandName ?? 'playwright-testing-a11y-summary'} [options]\n\n` +
+      'Options:\n' +
+      '  --report-path=PATH       Playwright JSON report (default: test-results/results.json)\n' +
+      '  --mode=summary           Write a Markdown accessibility summary (default)\n' +
+      '  --mode=annotations       Write GitHub Actions annotations\n' +
+      '  -h, --help               Show this help\n',
+    )
+    return
+  }
+
+  let mode = 'summary'
+  let reportPath = 'test-results/results.json'
+
+  for (const arg of args) {
+    if (arg.startsWith('--mode=')) mode = arg.slice('--mode='.length)
+    if (arg.startsWith('--report-path=')) reportPath = arg.slice('--report-path='.length)
+  }
+
+  const validModes = new Set(['summary', 'annotations'])
+  if (!validModes.has(mode)) {
+    console.error(`Unknown mode: ${mode}. Use summary or annotations.`)
+    process.exit(2)
+  }
+
+  // Resolve relative to cwd.
+  const resolvedPath = path.resolve(reportPath)
+
+  // Missing reports are intentionally non-fatal — the JSON report may be
+  // absent if no tests ran. Any other failure (parse error, permissions, etc.)
+  // should propagate so CI surfaces the real problem instead of silently
+  // reporting zero violations.
+  if (!fs.existsSync(resolvedPath)) {
+    console.error(
+      `Playwright JSON report not found at ${resolvedPath} — skipping a11y summary.`,
+    )
+    return
+  }
+
+  const report = parseA11yResults(resolvedPath)
+
+  switch (mode) {
+    case 'summary': {
+      const md = generateSummary(report)
+      const summaryFile = process.env.GITHUB_STEP_SUMMARY
+      if (summaryFile) {
+        fs.appendFileSync(summaryFile, md)
+        console.log('Accessibility summary written to $GITHUB_STEP_SUMMARY')
+      } else {
+        // Not in GitHub Actions — just print.
+        process.stdout.write(md)
+      }
+      break
+    }
+    case 'annotations': {
+      const output = generateAnnotations(report)
+      if (output) process.stdout.write(output + '\n')
+      break
+    }
+  }
+}
+
+// Auto-invoke when run directly (node lib/github/a11y-summary.js).
+if (require.main === module) {
+  main()
+}

package/src/github/attachments.test.ts

@@ -0,0 +1,248 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import * as fs from 'fs'
+import * as os from 'os'
+import * as path from 'path'
+import { AttachmentUploader, mimeTypeFor, FetchLike } from './attachments'
+
+let tmpDir: string
+
+beforeEach(() => {
+  tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'attachments-test-'))
+})
+
+afterEach(() => {
+  fs.rmSync(tmpDir, { recursive: true, force: true })
+})
+
+/** Write a file of a given size and return its path. */
+function writeFile(name: string, bytes = 16): string {
+  const filePath = path.join(tmpDir, name)
+  fs.writeFileSync(filePath, Buffer.alloc(bytes, 1))
+  return filePath
+}
+
+/** A fetch stub that records calls and replays canned responses. */
+function stubFetch(responses: Array<{ ok: boolean; status: number; body: string }>) {
+  const calls: string[] = []
+  const headers: Array<Record<string, string>> = []
+  const impl: FetchLike = async (url, init) => {
+    calls.push(url)
+    headers.push(init.headers)
+    const next = responses.shift() ?? { ok: true, status: 201, body: '{"url":"https://example.test/a"}' }
+    return {
+      ok: next.ok,
+      status: next.status,
+      text: async () => next.body,
+    }
+  }
+  return { impl, calls, headers }
+}
+
+describe('mimeTypeFor', () => {
+  it('maps the image types GitHub renders inline', () => {
+    expect(mimeTypeFor('a/b/diff.png')).toBe('image/png')
+    expect(mimeTypeFor('shot.JPEG')).toBe('image/jpeg')
+    expect(mimeTypeFor('clip.webm')).toBe('video/webm')
+    expect(mimeTypeFor('icon.svg')).toBe('image/svg+xml')
+    expect(mimeTypeFor('clip.MOV')).toBe('video/quicktime')
+  })
+
+  it('falls back to a generic type for anything else', () => {
+    expect(mimeTypeFor('report.txt')).toBe('application/octet-stream')
+  })
+})
+
+describe('AttachmentUploader', () => {
+  it('is off without a token, which is the normal case', async () => {
+    const uploader = new AttachmentUploader({ repositoryId: '1' })
+    expect(uploader.enabled).toBe(false)
+    expect(uploader.disabledReason).toMatch(/no upload token/)
+    expect(await uploader.upload(writeFile('a.png'))).toBeNull()
+  })
+
+  it('is off without a repository ID', () => {
+    const uploader = new AttachmentUploader({ token: 't' })
+    expect(uploader.enabled).toBe(false)
+    expect(uploader.disabledReason).toMatch(/repository ID/)
+  })
+
+  it('returns the asset URL and passes the endpoint what it needs', async () => {
+    const { impl, calls } = stubFetch([
+      { ok: true, status: 201, body: '{"url":"https://github.com/user-attachments/assets/abc"}' },
+    ])
+    const uploader = new AttachmentUploader({ token: 't', repositoryId: '42', fetchImpl: impl })
+
+    const url = await uploader.upload(writeFile('diff.png'))
+
+    expect(url).toBe('https://github.com/user-attachments/assets/abc')
+    expect(calls[0]).toContain('repository_id=42')
+    expect(calls[0]).toContain('content_type=image%2Fpng')
+    expect(calls[0]).toContain('name=diff.png')
+    expect(uploader.getStats().uploaded).toBe(1)
+  })
+
+  it('sends a Content-Type, which the endpoint rejects the request without', async () => {
+    // Node's fetch sends no Content-Type for a Buffer body, and the endpoint
+    // answers 400 "Invalid Content-Type" when it is missing.
+    const { impl, headers } = stubFetch([])
+    const uploader = new AttachmentUploader({ token: 't', repositoryId: '1', fetchImpl: impl })
+
+    await uploader.upload(writeFile('diff.png'))
+
+    expect(headers[0]['Content-Type']).toBe('image/png')
+  })
+
+  it('reports the response body when the endpoint refuses', async () => {
+    const { impl } = stubFetch([
+      { ok: false, status: 400, body: '{"message":"Invalid Content-Type"}' },
+    ])
+    const uploader = new AttachmentUploader({ token: 't', repositoryId: '1', fetchImpl: impl })
+
+    await uploader.upload(writeFile('a.png'))
+
+    expect(uploader.disabledReason).toContain('Invalid Content-Type')
+  })
+
+  it('accepts href as well as url, since write-ups disagree', async () => {
+    const { impl } = stubFetch([{ ok: true, status: 201, body: '{"href":"https://example.test/h"}' }])
+    const uploader = new AttachmentUploader({ token: 't', repositoryId: '1', fetchImpl: impl })
+
+    expect(await uploader.upload(writeFile('a.png'))).toBe('https://example.test/h')
+  })
+
+  it('stops for the rest of the run after one failure', async () => {
+    const { impl, calls } = stubFetch([{ ok: false, status: 404, body: '{"message":"Not Found"}' }])
+    const uploader = new AttachmentUploader({ token: 't', repositoryId: '1', fetchImpl: impl })
+
+    expect(await uploader.upload(writeFile('one.png'))).toBeNull()
+    expect(uploader.enabled).toBe(false)
+    expect(uploader.disabledReason).toMatch(/HTTP 404/)
+
+    // The second attempt must not reach the endpoint at all.
+    expect(await uploader.upload(writeFile('two.png'))).toBeNull()
+    expect(calls).toHaveLength(1)
+  })
+
+  it('stops when the endpoint answers without a URL', async () => {
+    const { impl } = stubFetch([{ ok: true, status: 200, body: 'not json' }])
+    const uploader = new AttachmentUploader({ token: 't', repositoryId: '1', fetchImpl: impl })
+
+    expect(await uploader.upload(writeFile('a.png'))).toBeNull()
+    expect(uploader.disabledReason).toMatch(/no URL/)
+  })
+
+  it('stops rather than throwing when fetch rejects', async () => {
+    const impl: FetchLike = async () => {
+      throw new Error('socket hang up')
+    }
+    const uploader = new AttachmentUploader({ token: 't', repositoryId: '1', fetchImpl: impl })
+
+    expect(await uploader.upload(writeFile('a.png'))).toBeNull()
+    expect(uploader.disabledReason).toMatch(/socket hang up/)
+  })
+
+  it('enforces the upload count budget and says so', async () => {
+    const { impl } = stubFetch([])
+    const uploader = new AttachmentUploader({
+      token: 't',
+      repositoryId: '1',
+      maxUploads: 1,
+      fetchImpl: impl,
+    })
+
+    expect(await uploader.upload(writeFile('one.png'))).not.toBeNull()
+    expect(await uploader.upload(writeFile('two.png'))).toBeNull()
+    expect(uploader.disabledReason).toMatch(/upload limit of 1/)
+  })
+
+  it('skips a file over GitHub\'s size limit and keeps going', async () => {
+    // GitHub refuses an image over 10 MB, and a rejection would otherwise
+    // switch uploading off for every image behind it.
+    const { impl, calls } = stubFetch([])
+    const uploader = new AttachmentUploader({
+      token: 't',
+      repositoryId: '1',
+      maxFileBytes: 100,
+      fetchImpl: impl,
+    })
+
+    expect(await uploader.upload(writeFile('huge.png', 200))).toBeNull()
+    expect(uploader.enabled).toBe(true)
+    expect(uploader.lastSkipReason).toBe('too-large')
+    // Nothing was sent for it: the limit is checked before the request.
+    expect(calls).toHaveLength(0)
+
+    expect(await uploader.upload(writeFile('small.png', 10))).not.toBeNull()
+    expect(uploader.lastSkipReason).toBeNull()
+    expect(uploader.getStats()).toEqual({ uploaded: 1, skipped: 1, bytes: 10 })
+  })
+
+  it('skips a file that does not fit the byte budget, rather than stopping', async () => {
+    const { impl } = stubFetch([])
+    const uploader = new AttachmentUploader({
+      token: 't',
+      repositoryId: '1',
+      maxTotalBytes: 100,
+      fetchImpl: impl,
+    })
+
+    expect(await uploader.upload(writeFile('first.png', 60))).not.toBeNull()
+    expect(await uploader.upload(writeFile('big.png', 60))).toBeNull()
+    expect(uploader.lastSkipReason).toBe('budget')
+
+    // The budget is a ceiling on the total, not a stop: what still fits goes.
+    expect(await uploader.upload(writeFile('last.png', 30))).not.toBeNull()
+    expect(uploader.enabled).toBe(true)
+    expect(uploader.getStats().bytes).toBe(90)
+  })
+
+  it('tells an unreadable file apart from one the limits refused', async () => {
+    const { impl } = stubFetch([{ ok: false, status: 404, body: '{"message":"Not Found"}' }])
+    const uploader = new AttachmentUploader({
+      token: 't',
+      repositoryId: '1',
+      maxFileBytes: 100,
+      fetchImpl: impl,
+    })
+
+    await uploader.upload(path.join(tmpDir, 'missing.png'))
+    expect(uploader.lastSkipReason).toBe('unreadable')
+
+    await uploader.upload(writeFile('huge.png', 200))
+    expect(uploader.lastSkipReason).toBe('too-large')
+
+    // A dead endpoint is the run's problem rather than any one file's.
+    await uploader.upload(writeFile('fine.png', 10))
+    expect(uploader.lastSkipReason).toBe('disabled')
+    expect(uploader.enabled).toBe(false)
+  })
+
+  it('skips an unreadable file without giving up on the rest', async () => {
+    const { impl } = stubFetch([])
+    const uploader = new AttachmentUploader({ token: 't', repositoryId: '1', fetchImpl: impl })
+
+    expect(await uploader.upload(path.join(tmpDir, 'missing.png'))).toBeNull()
+    expect(uploader.enabled).toBe(true)
+    expect(await uploader.upload(writeFile('present.png'))).not.toBeNull()
+  })
+
+  it('reduces a name of nothing but dashes to a usable one', async () => {
+    // Trimming these with /^-+|-+$/ backtracks quadratically, so the trim is an
+    // index scan instead. Long runs of dashes are the shape that provokes it.
+    const { impl, calls } = stubFetch([])
+    const uploader = new AttachmentUploader({ token: 't', repositoryId: '1', fetchImpl: impl })
+
+    await uploader.upload(writeFile('a.png'), `${'-'.repeat(50000)}b.png`)
+
+    expect(calls[0]).toContain('name=attachment')
+  })
+
+  it('reduces awkward file names to something a query string can carry', async () => {
+    const { impl, calls } = stubFetch([])
+    const uploader = new AttachmentUploader({ token: 't', repositoryId: '1', fetchImpl: impl })
+
+    await uploader.upload(writeFile('weird.png'), 'homepage renders "correctly" & fast.png')
+
+    expect(calls[0]).toContain('name=homepage-renders-correctly-fast.png')
+  })
+})