browser-commander 0.16.0 → 0.17.0

package/tests/unit/scripts/ci-workflow-policy.test.js

@@ -18,32 +18,82 @@ function withWorkflow(content, callback) {
   }
 }
 
+/**
+ * Build a workflow that already satisfies every unrelated policy rule.
+ *
+ * Each test then varies exactly one thing, so a failure count of N names the N
+ * rules under test instead of the scaffolding around them.
+ *
+ * @param {{on?: string, preamble?: string, job?: string, steps: string}} parts
+ * @returns {string}
+ */
+function workflow({ on = 'push', preamble = '', job = 'test', steps }) {
+  return [
+    'name: Test',
+    `on: ${on}`,
+    preamble,
+    'env:',
+    '  GIT_CONFIG_KEY_0: init.defaultBranch',
+    'jobs:',
+    `  ${job}:`,
+    '    runs-on: ubuntu-latest',
+    '    timeout-minutes: 5',
+    '    concurrency:',
+    `      group: \${{ github.workflow }}-\${{ github.ref }}-${job}`,
+    '      cancel-in-progress: true',
+    '    steps:',
+    '      - uses: actions/checkout@v6',
+    steps,
+    // Every workflow has to end in the gate that reads the other jobs'
+    // results, so the scaffolding carries one; the gate's own tests are in
+    // ci-timeout-budgets.test.js.
+    '  pipeline-status:',
+    '    runs-on: ubuntu-latest',
+    '    timeout-minutes: 5',
+    '    concurrency:',
+    '      group: ${{ github.workflow }}-${{ github.ref }}-pipeline-status',
+    '      cancel-in-progress: true',
+    `    needs: [${job}]`,
+    '    steps:',
+    '      - run: bash scripts/check-pipeline-status.sh',
+    '',
+  ]
+    .filter((section) => section !== '')
+    .join('\n');
+}
+
+/**
+ * Count policy failures without letting the reported ::error:: lines leak into
+ * the test output, where they read like real CI annotations.
+ *
+ * @param {string} content
+ * @returns {number}
+ */
+function countFailures(content) {
+  const originalError = console.error;
+  console.error = () => {};
+
+  try {
+    return withWorkflow(content, checkWorkflow);
+  } finally {
+    console.error = originalError;
+  }
+}
+
 describe('CI workflow policy', () => {
   it('accepts bounded job-scoped checks', () => {
-    const workflow = `name: Test
-on: push
-permissions:
-  contents: read
-env:
-  GIT_CONFIG_KEY_0: init.defaultBranch
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    concurrency:
-      group: \${{ github.workflow }}-\${{ github.ref }}-test
-      cancel-in-progress: true
-    steps:
-      - uses: actions/checkout@v6
-`;
+    const content = workflow({
+      preamble: 'permissions:\n  contents: read',
+      steps: '      - run: npm ci --ignore-scripts',
+    });
 
-    withWorkflow(workflow, (filePath) => {
+    withWorkflow(content, (filePath) => {
       assert.equal(checkWorkflow(filePath), 0);
     });
   });
 
   it('rejects workflow-wide cancellation and unbounded jobs', () => {
-    const workflow = `name: Test
+    const content = `name: Test
 on: push
 concurrency:
   group: test
@@ -59,15 +109,154 @@ jobs:
         with:
           file: coverage.xml
 `;
-    const originalError = console.error;
-    console.error = () => {};
-
-    try {
-      withWorkflow(workflow, (filePath) => {
-        assert.equal(checkWorkflow(filePath), 7);
-      });
-    } finally {
-      console.error = originalError;
-    }
+
+    // The eighth is the missing pipeline-status gate: with no job reading the
+    // other jobs' results, a check killed by timeout-minutes is reported as
+    // cancelled and fails nothing.
+    assert.equal(countFailures(content), 8);
+  });
+
+  it('rejects untrusted expressions interpolated into run bodies', () => {
+    const content = workflow({
+      on: '\n  workflow_dispatch:\n    inputs:\n      bump_type:\n        type: choice\n        options:\n          - patch\n      description:\n        type: string',
+      job: 'release',
+      steps: [
+        '      - run: echo "${{ github.base_ref }}"',
+        '      - run: bump "${{ github.event.inputs.bump_type }}" "${{ github.event.inputs.description }}"',
+        '      - uses: peter-evans/create-pull-request@v7',
+        '        with:',
+        "          title: 'release ${{ github.event.inputs.description }}'",
+      ].join('\n'),
+    });
+
+    // One github.base_ref interpolation, one free-form input inside a run body
+    // (bump_type is a choice input, and the create-pull-request title is an
+    // action input rather than a shell body), one outdated action.
+    assert.equal(countFailures(content), 3);
+  });
+
+  it('rejects a condition that starts with the YAML tag indicator', () => {
+    const content = workflow({
+      steps:
+        "      - run: echo ok\n    if: !cancelled() && github.event_name == 'push'",
+    });
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('rejects outdated setup-python and codecov versions', () => {
+    const content = workflow({
+      steps: [
+        '      - uses: actions/setup-python@v5',
+        '      - uses: codecov/codecov-action@v6',
+      ].join('\n'),
+    });
+
+    assert.equal(countFailures(content), 2);
+  });
+
+  it('accepts a base_ref bound to any environment variable name', () => {
+    const content = workflow({
+      on: 'pull_request',
+      steps: [
+        '      - name: Simulate fresh merge',
+        '        env:',
+        '          BASE_REF: ${{ github.base_ref }}',
+        '        run: bash scripts/simulate-fresh-merge.sh',
+      ].join('\n'),
+    });
+
+    withWorkflow(content, (filePath) => {
+      assert.equal(checkWorkflow(filePath), 0);
+    });
+  });
+
+  it('still rejects a base_ref spliced into a run body', () => {
+    const content = workflow({
+      on: 'pull_request',
+      steps: '      - run: git fetch origin ${{ github.base_ref }}',
+    });
+
+    assert.ok(countFailures(content) > 0);
+  });
+
+  it('rejects a version scraped out of pyproject.toml with grep', () => {
+    // The exact command that shipped in python.yml until this pull request.
+    // pyproject.toml carries `version` under [project] and under [tool.scriv],
+    // so this grep wrote two lines into $GITHUB_OUTPUT and failed the step.
+    const content = workflow({
+      steps: [
+        '      - run: |',
+        `          CURRENT_VERSION=$(grep -Po '(?<=^version = ")[^"]*' pyproject.toml)`,
+        '          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT',
+      ].join('\n'),
+    });
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('rejects a crate name scraped out of Cargo.toml with head -1', () => {
+    // `head -1` is ordering-dependent, not table-aware: Cargo.toml repeats
+    // `name` under [[bin]] and [lib].
+    const content = workflow({
+      steps: `      - run: grep '^name' Cargo.toml | head -1 | cut -d'"' -f2`,
+    });
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('rejects a workflow with no pipeline-status gate', () => {
+    // A job killed by timeout-minutes is reported as cancelled, and a run whose
+    // only casualty is a cancelled job is filed under cancelled too, so without
+    // this gate the overrun fails nothing.
+    const content = workflow({
+      steps: '      - run: npm ci --ignore-scripts',
+    }).replace(/ {2}pipeline-status:[\s\S]*$/, '');
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('rejects a gate that has stopped watching a job', () => {
+    const content = `${workflow({
+      steps: '      - run: npm ci --ignore-scripts',
+    })}
+  drifted:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    concurrency:
+      group: \${{ github.workflow }}-\${{ github.ref }}-drifted
+      cancel-in-progress: true
+    steps:
+      - run: echo drifted
+`;
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('accepts the table-aware manifest readers', () => {
+    const content = workflow({
+      steps: [
+        '      - run: python scripts/read_manifest.py pyproject.toml --output current_version',
+        '      - run: node ../scripts/read-manifest.mjs Cargo.toml --field name',
+      ].join('\n'),
+    });
+
+    withWorkflow(content, (filePath) => {
+      assert.equal(checkWorkflow(filePath), 0);
+    });
+  });
+
+  it('leaves a commented-out manifest grep alone', () => {
+    const content = workflow({
+      steps: [
+        '      - run: |',
+        `          # Replaced grep -Po '(?<=^version = ")[^"]*' pyproject.toml`,
+        '          python scripts/read_manifest.py pyproject.toml --output version',
+      ].join('\n'),
+    });
+
+    withWorkflow(content, (filePath) => {
+      assert.equal(checkWorkflow(filePath), 0);
+    });
   });
 });

package/tests/unit/scripts/debug-print.test.js

@@ -0,0 +1,67 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+
+import {
+  debugWith,
+  formatDebugLines,
+  isDebugEnabled,
+  readEnvVar,
+} from '../../../../scripts/debug-print.mjs';
+
+describe('debug-print', () => {
+  it('stays off by default so release logs are not noisy', () => {
+    assert.equal(isDebugEnabled({}), false);
+    assert.equal(isDebugEnabled({ CI_SCRIPTS_DEBUG: '0' }), false);
+    assert.equal(isDebugEnabled({ CI_SCRIPTS_DEBUG: '' }), false);
+  });
+
+  it('turns on through the local toggle or either Actions debug switch', () => {
+    assert.equal(isDebugEnabled({ CI_SCRIPTS_DEBUG: '1' }), true);
+    assert.equal(isDebugEnabled({ CI_SCRIPTS_DEBUG: 'true' }), true);
+    assert.equal(isDebugEnabled({ RUNNER_DEBUG: '1' }), true);
+    assert.equal(isDebugEnabled({ ACTIONS_STEP_DEBUG: 'true' }), true);
+  });
+
+  it('prefixes every line so Actions renders it in the debug stream', () => {
+    assert.deepEqual(formatDebugLines(['a\nb']), ['::debug::a', '::debug::b']);
+    assert.deepEqual(formatDebugLines(['keys', { a: 1 }]), [
+      '::debug::keys {',
+      '::debug::  "a": 1',
+      '::debug::}',
+    ]);
+  });
+
+  it('prints nothing when debug output is off', () => {
+    const printed = [];
+    assert.deepEqual(
+      debugWith({ env: {}, log: (l) => printed.push(l) }, 'x'),
+      []
+    );
+    assert.deepEqual(printed, []);
+  });
+
+  it('prints through the injected logger when debug output is on', () => {
+    const printed = [];
+    debugWith(
+      { env: { CI_SCRIPTS_DEBUG: '1' }, log: (line) => printed.push(line) },
+      'loaded',
+      { keys: ['default'] }
+    );
+    assert.equal(printed[0], '::debug::loaded {');
+  });
+
+  it('treats an unreadable environment as unset instead of throwing', () => {
+    // Deno raises NotCapable on the property read when --allow-env is absent;
+    // tracing must never be the reason a script fails.
+    const hostile = new Proxy(
+      {},
+      {
+        get() {
+          throw new Error('NotCapable');
+        },
+      }
+    );
+    assert.equal(readEnvVar('CI_SCRIPTS_DEBUG', hostile), undefined);
+    assert.equal(isDebugEnabled(hostile), false);
+  });
+});

package/tests/unit/scripts/jscpd-config.test.js

@@ -0,0 +1,141 @@
+/**
+ * Guard against a duplication gate that reports success without reading code.
+ *
+ * `.jscpd.json` used to set `"format": "console"`, but jscpd's `format` selects
+ * the *file formats* to scan, not the reporter. No file has the extension
+ * `console`, so `npm run check:duplication` analysed 0 files, found 0 clones and
+ * exited 0 for every commit - a green check that proved nothing. The static
+ * assertions below pin the keys that caused it; the end-to-end run proves the
+ * shipped config still reaches a real file.
+ */
+
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import {
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const JS_ROOT = path.resolve(
+  fileURLToPath(new URL('.', import.meta.url)),
+  '../../..'
+);
+const CONFIG_PATH = path.join(JS_ROOT, '.jscpd.json');
+const JSCPD_PACKAGE = path.join(JS_ROOT, 'node_modules', 'jscpd');
+
+/**
+ * Resolve jscpd's CLI entry point, not its `node_modules/.bin` shim.
+ *
+ * On Windows npm writes three shims - `jscpd`, `jscpd.cmd` and `jscpd.ps1` -
+ * and the extensionless one is a Bourne script that `CreateProcess` cannot
+ * execute, so `execFileSync(.bin/jscpd)` fails with ENOENT there while working
+ * on Linux and macOS. Reading `bin.jscpd` out of the package manifest gives the
+ * same file npm links to, on every platform, and survives an upstream rename.
+ */
+function resolveJscpdCli() {
+  const manifest = path.join(JSCPD_PACKAGE, 'package.json');
+  if (!existsSync(manifest)) {
+    return null;
+  }
+  const { bin } = JSON.parse(readFileSync(manifest, 'utf-8'));
+  const entry = typeof bin === 'string' ? bin : bin?.jscpd;
+  if (!entry) {
+    return null;
+  }
+  const cli = path.join(JSCPD_PACKAGE, entry);
+  return existsSync(cli) ? cli : null;
+}
+
+const config = JSON.parse(readFileSync(CONFIG_PATH, 'utf-8'));
+
+describe('.jscpd.json', () => {
+  it('does not restrict the scan to a format named after a reporter', () => {
+    // `format` is a comma-separated list of jscpd language ids ("javascript",
+    // "markup", ...). Naming a reporter there silently matches nothing.
+    assert.equal(
+      config.format,
+      undefined,
+      '`format` filters which file types are scanned; use `reporters` instead'
+    );
+  });
+
+  it('selects reporters through the `reporters` array', () => {
+    assert.ok(Array.isArray(config.reporters), '`reporters` must be an array');
+    assert.ok(
+      config.reporters.includes('console'),
+      'console output is what makes a failing run readable in CI logs'
+    );
+  });
+
+  it('asks to ignore comments through `mode`, not an unknown key', () => {
+    // jscpd warns "unknown field 'skipComments'" and carries on; `mode: weak`
+    // is the supported spelling of the same intent.
+    assert.equal(config.skipComments, undefined);
+    assert.equal(config.mode, 'weak');
+  });
+});
+
+describe('the shipped jscpd config scans real files', () => {
+  it('reports at least one analysed source for a one-file project', (t) => {
+    const jscpdCli = resolveJscpdCli();
+    if (!jscpdCli) {
+      return t.skip(
+        `jscpd is not installed under ${JSCPD_PACKAGE}; run npm ci in js/`
+      );
+    }
+
+    const fixture = mkdtempSync(path.join(tmpdir(), 'jscpd-config-'));
+    try {
+      // jscpd reads `.jscpd.json` from the directory it is invoked in, so the
+      // fixture gets a copy of the real config rather than a --config path.
+      writeFileSync(
+        path.join(fixture, '.jscpd.json'),
+        readFileSync(CONFIG_PATH)
+      );
+      writeFileSync(
+        path.join(fixture, 'sample.js'),
+        [
+          'export function sample(value) {',
+          '  return value + 1;',
+          '}',
+          '',
+        ].join('\n')
+      );
+
+      const output = path.join(fixture, 'report');
+      execFileSync(
+        process.execPath,
+        [
+          jscpdCli,
+          '.',
+          '--reporters',
+          'json',
+          '--output',
+          output,
+          '--no-colors',
+        ],
+        {
+          cwd: fixture,
+          stdio: 'pipe',
+        }
+      );
+
+      const report = JSON.parse(
+        readFileSync(path.join(output, 'jscpd-report.json'), 'utf-8')
+      );
+      assert.ok(
+        report.statistics.total.sources > 0,
+        `jscpd analysed ${report.statistics.total.sources} files; the config excludes everything`
+      );
+    } finally {
+      rmSync(fixture, { recursive: true, force: true });
+    }
+  });
+});

package/tests/unit/scripts/pre-commit-config.test.js

@@ -0,0 +1,209 @@
+/**
+ * The local quality gate has to be the same gate CI uses.
+ *
+ * Before this test the repository claimed pre-commit hooks through husky:
+ * `js/package.json` ran `"prepare": "husky || true"`, husky refused with
+ * `.git can't be found` because npm runs `prepare` inside `js/`, and `|| true`
+ * threw the refusal away. `git config --get core.hooksPath` stayed empty, so
+ * `js/.husky/pre-commit` never ran for anyone - the same shape of failure as the
+ * `|| true` that once hid a Prettier error in the release job.
+ *
+ * The replacement is a repository-root `.pre-commit-config.yaml` whose local
+ * hooks run the exact commands the workflows run. The assertions below pin that
+ * correspondence: change a lint command in a workflow without changing the hook
+ * (or the other way round) and this test fails.
+ */
+
+import assert from 'node:assert/strict';
+import { existsSync, readFileSync } from 'node:fs';
+import { describe, it } from 'node:test';
+
+import {
+  normalizeNewlines,
+  readRepoText,
+  repoPath,
+} from '../../helpers/repo.js';
+
+/**
+ * Every local hook, mapped to the workflow step it has to mirror.
+ *
+ * `command` is matched twice: it must appear inside the hook's `entry`, and the
+ * workflow must contain a `run:` step that is exactly that command.
+ */
+const MIRRORED_COMMANDS = [
+  { id: 'js-eslint', workflow: 'js.yml', command: 'npm run lint' },
+  { id: 'js-prettier', workflow: 'js.yml', command: 'npm run format:check' },
+  {
+    id: 'js-duplication',
+    workflow: 'js.yml',
+    command: 'npm run check:duplication',
+  },
+  { id: 'python-ruff', workflow: 'python.yml', command: 'ruff check .' },
+  {
+    id: 'python-ruff-format',
+    workflow: 'python.yml',
+    command: 'ruff format --check .',
+  },
+  { id: 'python-mypy', workflow: 'python.yml', command: 'mypy src' },
+  {
+    id: 'python-mypy-scripts',
+    workflow: 'python.yml',
+    command: 'mypy --python-version 3.13 scripts tests/unit/scripts',
+  },
+  {
+    id: 'rust-fmt',
+    workflow: 'rust.yml',
+    command: 'cargo fmt --all -- --check',
+  },
+  {
+    id: 'rust-clippy',
+    workflow: 'rust.yml',
+    command: 'cargo clippy --all-targets --all-features',
+  },
+  {
+    id: 'file-line-limits',
+    workflow: 'quality.yml',
+    command: 'bash scripts/check-file-line-limits.sh',
+  },
+  {
+    id: 'shared-fingerprint-assets',
+    workflow: 'quality.yml',
+    command: 'bash scripts/check-shared-fingerprint-assets.sh',
+  },
+  {
+    id: 'repo-scripts-lint',
+    workflow: 'quality.yml',
+    command:
+      'node js/node_modules/eslint/bin/eslint.js scripts experiments rust/scripts',
+  },
+  {
+    id: 'ci-workflow-policy',
+    workflow: 'ci-policy.yml',
+    command: 'node scripts/check-ci-workflows.mjs',
+  },
+];
+
+/**
+ * Collect the `repo: local` hooks as `id -> lines of that hook`.
+ *
+ * A regex reader rather than a YAML parser, for the same reason
+ * `scripts/check-ci-workflows.mjs` uses one: this repository ships no YAML
+ * dependency, and a policy check that needs one is a policy check that stops
+ * being run.
+ *
+ * @param {string} text - contents of .pre-commit-config.yaml
+ * @returns {Map<string, string[]>}
+ */
+function readLocalHooks(text) {
+  const localSection = text.slice(text.indexOf('- repo: local'));
+  const hooks = new Map();
+  let current = null;
+
+  for (const line of localSection.split(/\r?\n/)) {
+    const id = line.match(/^\s*-\s+id:\s+(\S+)/);
+    if (id) {
+      current = [];
+      hooks.set(id[1], current);
+      continue;
+    }
+    if (current) {
+      current.push(line);
+    }
+  }
+  return hooks;
+}
+
+/**
+ * @param {string[]} lines - the lines of one hook
+ * @returns {string} the hook's `entry` value
+ */
+function entryOf(lines) {
+  const entry = lines.find((line) => /^\s*entry:\s/.test(line));
+  return entry ? entry.replace(/^\s*entry:\s+/, '').trim() : '';
+}
+
+const localHooks = readLocalHooks(readRepoText('.pre-commit-config.yaml'));
+
+const workflow = (name) => readRepoText('.github', 'workflows', name);
+
+describe('local hooks run the commands CI runs', () => {
+  for (const { id, workflow: file, command } of MIRRORED_COMMANDS) {
+    it(`${id} runs \`${command}\`, the same as ${file}`, () => {
+      const lines = localHooks.get(id);
+      assert.ok(lines, `no \`${id}\` hook in .pre-commit-config.yaml`);
+      assert.ok(
+        entryOf(lines).includes(command),
+        `${id} must run \`${command}\`; its entry is \`${entryOf(lines)}\``
+      );
+      assert.ok(
+        workflow(file).includes(`run: ${command}\n`),
+        `${file} no longer has a step running \`${command}\`; the hook and the workflow have drifted apart`
+      );
+    });
+  }
+
+  it('reads a workflow checked out with Windows line endings', () => {
+    // The twelve assertions above match `run: <command>\n`. On windows-latest
+    // git checks the repository out with CRLF endings, so every one of them
+    // failed there while passing on Linux - run 33963736349, twelve failures,
+    // none of them a real drift. Reading through readRepoText() is what makes
+    // the assertion about this repository rather than about the runner.
+    const crlfWorkflow = normalizeNewlines(
+      workflow('js.yml').replaceAll('\n', '\r\n')
+    );
+
+    assert.ok(crlfWorkflow.includes('run: npm run lint\n'));
+  });
+
+  it('leaves no local hook unpinned', () => {
+    const pinned = new Set(MIRRORED_COMMANDS.map((m) => m.id));
+    const unpinned = [...localHooks.keys()].filter((id) => !pinned.has(id));
+    assert.deepEqual(
+      unpinned,
+      [],
+      'every local hook must be listed in MIRRORED_COMMANDS so it cannot drift from CI'
+    );
+  });
+
+  it('never lets pre-commit append filenames to a `bash -c` entry', () => {
+    // `bash -c 'cmd' a.js b.js` passes the files as $0/$1, which bash ignores:
+    // the hook would keep passing while checking something else entirely.
+    for (const [id, lines] of localHooks) {
+      assert.ok(
+        lines.some((line) => /^\s*pass_filenames:\s+false\s*$/.test(line)),
+        `${id} must set pass_filenames: false`
+      );
+    }
+  });
+
+  it('gives clippy the flag that makes a warning fatal in CI', () => {
+    // rust.yml sets RUSTFLAGS at workflow level, which is the only reason
+    // `cargo clippy` without `-D warnings` is a real gate there.
+    assert.ok(entryOf(localHooks.get('rust-clippy')).includes('-Dwarnings'));
+    assert.ok(workflow('rust.yml').includes('RUSTFLAGS: -Dwarnings'));
+  });
+});
+
+describe('the previous hook wiring is gone', () => {
+  const manifest = JSON.parse(
+    readFileSync(repoPath('js', 'package.json'), 'utf-8')
+  );
+
+  it('installs no git hook through a masked command', () => {
+    for (const [name, command] of Object.entries(manifest.scripts)) {
+      assert.ok(
+        !/\|\|\s*true\s*$/.test(command),
+        `npm script \`${name}\` ends in \`|| true\`, which hides its own failure`
+      );
+    }
+  });
+
+  it('keeps no husky wiring that cannot reach .git from js/', () => {
+    // husky refuses any path containing `..` and requires `.git` in the working
+    // directory, so it cannot manage a repository-root hook from this package.
+    assert.equal(manifest.devDependencies.husky, undefined);
+    assert.equal(manifest.devDependencies['lint-staged'], undefined);
+    assert.equal(manifest['lint-staged'], undefined);
+    assert.ok(!existsSync(repoPath('js', '.husky')));
+  });
+});