browser-commander 0.16.0 → 0.16.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.16.1
+
+### Patch Changes
+
+- 542bf75: Fix CI/CD false positives, false negatives and warnings across all workflows
+  - Repair `if:` conditions that started with `!`, which a YAML plain scalar cannot do
+  - Replace `always()` with `!cancelled()` so cancelled runs stop propagating
+  - Gate `instant-release` and `changeset-pr` on lint and test, so a manual release can no longer publish unvalidated code
+  - Make the changelog fragment checks fail instead of only warning
+  - Pass `github.base_ref` and free-form `workflow_dispatch` inputs through environment variables instead of interpolating them into shell bodies
+  - Update `actions/setup-python` to v6, `codecov/codecov-action` to v7 and `peter-evans/create-pull-request` to v8
+  - Extend `scripts/check-ci-workflows.mjs` so each of the above becomes a permanent policy check
+  - Add repository-wide secrets scanning and a 1500-line file limit gate
+
 ## 0.16.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "browser-commander",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "Universal browser automation library that supports both Playwright and Puppeteer with a unified API",
   "main": "src/index.js",
   "type": "module",

package/tests/unit/scripts/check-version-modification.test.js

@@ -0,0 +1,70 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+
+import { findManualVersionChanges } from '../../../../scripts/check-version-modification.mjs';
+
+// The real implementation shells out to git; injecting the diff keeps these
+// cases independent of the branch the suite happens to run on.
+function stubDiff(diffsByPath) {
+  return (_baseRef, path) => diffsByPath[path] ?? '';
+}
+
+describe('check-version-modification', () => {
+  it('reports nothing when no manifest changed', () => {
+    assert.deepEqual(findManualVersionChanges('main', stubDiff({})), []);
+  });
+
+  it('detects a hand-edited package.json version', () => {
+    const diff = stubDiff({
+      'js/package.json': [
+        '--- a/js/package.json',
+        '+++ b/js/package.json',
+        '-  "version": "0.16.0",',
+        '+  "version": "0.17.0",',
+      ].join('\n'),
+    });
+
+    assert.deepEqual(findManualVersionChanges('main', diff), [
+      'js/package.json',
+    ]);
+  });
+
+  it('detects hand-edited pyproject and Cargo versions together', () => {
+    const diff = stubDiff({
+      'python/pyproject.toml': '+version = "0.5.4"',
+      'rust/Cargo.toml': '+version = "0.9.1"',
+    });
+
+    assert.deepEqual(findManualVersionChanges('main', diff), [
+      'python/pyproject.toml',
+      'rust/Cargo.toml',
+    ]);
+  });
+
+  it('ignores a non-numeric version key', () => {
+    // pyproject declares `version = "literal: pyproject.toml: project.version"`
+    // for its release tooling; that is not a version bump.
+    const diff = stubDiff({
+      'python/pyproject.toml':
+        '+version = "literal: pyproject.toml: project.version"',
+    });
+
+    assert.deepEqual(findManualVersionChanges('main', diff), []);
+  });
+
+  it('ignores an unrelated edit to a manifest', () => {
+    const diff = stubDiff({
+      'js/package.json': '+  "description": "A new description",',
+    });
+
+    assert.deepEqual(findManualVersionChanges('main', diff), []);
+  });
+
+  it('ignores a removed version line', () => {
+    const diff = stubDiff({
+      'js/package.json': '-  "version": "0.16.0",',
+    });
+
+    assert.deepEqual(findManualVersionChanges('main', diff), []);
+  });
+});

package/tests/unit/scripts/ci-workflow-policy.test.js

@@ -70,4 +70,157 @@ jobs:
       console.error = originalError;
     }
   });
+
+  it('rejects untrusted expressions interpolated into run bodies', () => {
+    const workflow = `name: Test
+on:
+  workflow_dispatch:
+    inputs:
+      bump_type:
+        type: choice
+        options:
+          - patch
+      description:
+        type: string
+env:
+  GIT_CONFIG_KEY_0: init.defaultBranch
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    concurrency:
+      group: \${{ github.workflow }}-\${{ github.ref }}-release
+      cancel-in-progress: true
+    steps:
+      - uses: actions/checkout@v6
+      - run: echo "\${{ github.base_ref }}"
+      - run: bump "\${{ github.event.inputs.bump_type }}" "\${{ github.event.inputs.description }}"
+      - uses: peter-evans/create-pull-request@v7
+        with:
+          title: 'release \${{ github.event.inputs.description }}'
+`;
+    const originalError = console.error;
+    console.error = () => {};
+
+    try {
+      withWorkflow(workflow, (filePath) => {
+        // One github.base_ref interpolation, one free-form input inside a run
+        // body (bump_type is a choice input, and the create-pull-request title
+        // is an action input rather than a shell body), one outdated action.
+        assert.equal(checkWorkflow(filePath), 3);
+      });
+    } finally {
+      console.error = originalError;
+    }
+  });
+
+  it('rejects a condition that starts with the YAML tag indicator', () => {
+    const workflow = `name: Test
+on: push
+env:
+  GIT_CONFIG_KEY_0: init.defaultBranch
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    concurrency:
+      group: \${{ github.workflow }}-\${{ github.ref }}-test
+      cancel-in-progress: true
+    if: !cancelled() && github.event_name == 'push'
+    steps:
+      - uses: actions/checkout@v6
+`;
+    const originalError = console.error;
+    console.error = () => {};
+
+    try {
+      withWorkflow(workflow, (filePath) => {
+        assert.equal(checkWorkflow(filePath), 1);
+      });
+    } finally {
+      console.error = originalError;
+    }
+  });
+
+  it('rejects outdated setup-python and codecov versions', () => {
+    const workflow = `name: Test
+on: push
+env:
+  GIT_CONFIG_KEY_0: init.defaultBranch
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    concurrency:
+      group: \${{ github.workflow }}-\${{ github.ref }}-test
+      cancel-in-progress: true
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v5
+      - uses: codecov/codecov-action@v6
+`;
+    const originalError = console.error;
+    console.error = () => {};
+
+    try {
+      withWorkflow(workflow, (filePath) => {
+        assert.equal(checkWorkflow(filePath), 2);
+      });
+    } finally {
+      console.error = originalError;
+    }
+  });
+
+  it('accepts a base_ref bound to any environment variable name', () => {
+    const workflow = `name: Test
+on: pull_request
+env:
+  GIT_CONFIG_KEY_0: init.defaultBranch
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    concurrency:
+      group: \${{ github.workflow }}-\${{ github.ref }}-test
+      cancel-in-progress: true
+    steps:
+      - uses: actions/checkout@v6
+      - name: Simulate fresh merge
+        env:
+          BASE_REF: \${{ github.base_ref }}
+        run: bash scripts/simulate-fresh-merge.sh
+`;
+
+    withWorkflow(workflow, (filePath) => {
+      assert.equal(checkWorkflow(filePath), 0);
+    });
+  });
+
+  it('still rejects a base_ref spliced into a run body', () => {
+    const workflow = `name: Test
+on: pull_request
+env:
+  GIT_CONFIG_KEY_0: init.defaultBranch
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    concurrency:
+      group: \${{ github.workflow }}-\${{ github.ref }}-test
+      cancel-in-progress: true
+    steps:
+      - uses: actions/checkout@v6
+      - run: git fetch origin \${{ github.base_ref }}
+`;
+    const originalError = console.error;
+    console.error = () => {};
+
+    try {
+      withWorkflow(workflow, (filePath) => {
+        assert.ok(checkWorkflow(filePath) > 0);
+      });
+    } finally {
+      console.error = originalError;
+    }
+  });
 });