browser-commander 0.16.1 → 0.17.1

package/tests/unit/scripts/ci-workflow-policy.test.js

@@ -18,32 +18,82 @@ function withWorkflow(content, callback) {
   }
 }
 
+/**
+ * Build a workflow that already satisfies every unrelated policy rule.
+ *
+ * Each test then varies exactly one thing, so a failure count of N names the N
+ * rules under test instead of the scaffolding around them.
+ *
+ * @param {{on?: string, preamble?: string, job?: string, steps: string}} parts
+ * @returns {string}
+ */
+function workflow({ on = 'push', preamble = '', job = 'test', steps }) {
+  return [
+    'name: Test',
+    `on: ${on}`,
+    preamble,
+    'env:',
+    '  GIT_CONFIG_KEY_0: init.defaultBranch',
+    'jobs:',
+    `  ${job}:`,
+    '    runs-on: ubuntu-latest',
+    '    timeout-minutes: 5',
+    '    concurrency:',
+    `      group: \${{ github.workflow }}-\${{ github.ref }}-${job}`,
+    '      cancel-in-progress: true',
+    '    steps:',
+    '      - uses: actions/checkout@v6',
+    steps,
+    // Every workflow has to end in the gate that reads the other jobs'
+    // results, so the scaffolding carries one; the gate's own tests are in
+    // ci-timeout-budgets.test.js.
+    '  pipeline-status:',
+    '    runs-on: ubuntu-latest',
+    '    timeout-minutes: 5',
+    '    concurrency:',
+    '      group: ${{ github.workflow }}-${{ github.ref }}-pipeline-status',
+    '      cancel-in-progress: true',
+    `    needs: [${job}]`,
+    '    steps:',
+    '      - run: bash scripts/check-pipeline-status.sh',
+    '',
+  ]
+    .filter((section) => section !== '')
+    .join('\n');
+}
+
+/**
+ * Count policy failures without letting the reported ::error:: lines leak into
+ * the test output, where they read like real CI annotations.
+ *
+ * @param {string} content
+ * @returns {number}
+ */
+function countFailures(content) {
+  const originalError = console.error;
+  console.error = () => {};
+
+  try {
+    return withWorkflow(content, checkWorkflow);
+  } finally {
+    console.error = originalError;
+  }
+}
+
 describe('CI workflow policy', () => {
   it('accepts bounded job-scoped checks', () => {
-    const workflow = `name: Test
-on: push
-permissions:
-  contents: read
-env:
-  GIT_CONFIG_KEY_0: init.defaultBranch
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    concurrency:
-      group: \${{ github.workflow }}-\${{ github.ref }}-test
-      cancel-in-progress: true
-    steps:
-      - uses: actions/checkout@v6
-`;
+    const content = workflow({
+      preamble: 'permissions:\n  contents: read',
+      steps: '      - run: npm ci --ignore-scripts',
+    });
 
-    withWorkflow(workflow, (filePath) => {
+    withWorkflow(content, (filePath) => {
       assert.equal(checkWorkflow(filePath), 0);
     });
   });
 
   it('rejects workflow-wide cancellation and unbounded jobs', () => {
-    const workflow = `name: Test
+    const content = `name: Test
 on: push
 concurrency:
   group: test
@@ -59,168 +109,257 @@ jobs:
         with:
           file: coverage.xml
 `;
-    const originalError = console.error;
-    console.error = () => {};
 
-    try {
-      withWorkflow(workflow, (filePath) => {
-        assert.equal(checkWorkflow(filePath), 7);
-      });
-    } finally {
-      console.error = originalError;
-    }
+    // The eighth is the missing pipeline-status gate: with no job reading the
+    // other jobs' results, a check killed by timeout-minutes is reported as
+    // cancelled and fails nothing.
+    assert.equal(countFailures(content), 8);
   });
 
   it('rejects untrusted expressions interpolated into run bodies', () => {
-    const workflow = `name: Test
-on:
-  workflow_dispatch:
-    inputs:
-      bump_type:
-        type: choice
-        options:
-          - patch
-      description:
-        type: string
-env:
-  GIT_CONFIG_KEY_0: init.defaultBranch
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    concurrency:
-      group: \${{ github.workflow }}-\${{ github.ref }}-release
-      cancel-in-progress: true
-    steps:
-      - uses: actions/checkout@v6
-      - run: echo "\${{ github.base_ref }}"
-      - run: bump "\${{ github.event.inputs.bump_type }}" "\${{ github.event.inputs.description }}"
-      - uses: peter-evans/create-pull-request@v7
-        with:
-          title: 'release \${{ github.event.inputs.description }}'
-`;
-    const originalError = console.error;
-    console.error = () => {};
+    const content = workflow({
+      on: '\n  workflow_dispatch:\n    inputs:\n      bump_type:\n        type: choice\n        options:\n          - patch\n      description:\n        type: string',
+      job: 'release',
+      steps: [
+        '      - run: echo "${{ github.base_ref }}"',
+        '      - run: bump "${{ github.event.inputs.bump_type }}" "${{ github.event.inputs.description }}"',
+        '      - uses: peter-evans/create-pull-request@v7',
+        '        with:',
+        "          title: 'release ${{ github.event.inputs.description }}'",
+      ].join('\n'),
+    });
 
-    try {
-      withWorkflow(workflow, (filePath) => {
-        // One github.base_ref interpolation, one free-form input inside a run
-        // body (bump_type is a choice input, and the create-pull-request title
-        // is an action input rather than a shell body), one outdated action.
-        assert.equal(checkWorkflow(filePath), 3);
-      });
-    } finally {
-      console.error = originalError;
-    }
+    // One github.base_ref interpolation, one free-form input inside a run body
+    // (bump_type is a choice input, and the create-pull-request title is an
+    // action input rather than a shell body), one outdated action.
+    assert.equal(countFailures(content), 3);
   });
 
   it('rejects a condition that starts with the YAML tag indicator', () => {
-    const workflow = `name: Test
-on: push
-env:
-  GIT_CONFIG_KEY_0: init.defaultBranch
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    concurrency:
-      group: \${{ github.workflow }}-\${{ github.ref }}-test
-      cancel-in-progress: true
-    if: !cancelled() && github.event_name == 'push'
-    steps:
-      - uses: actions/checkout@v6
-`;
-    const originalError = console.error;
-    console.error = () => {};
+    const content = workflow({
+      steps:
+        "      - run: echo ok\n    if: !cancelled() && github.event_name == 'push'",
+    });
 
-    try {
-      withWorkflow(workflow, (filePath) => {
-        assert.equal(checkWorkflow(filePath), 1);
-      });
-    } finally {
-      console.error = originalError;
-    }
+    assert.equal(countFailures(content), 1);
   });
 
   it('rejects outdated setup-python and codecov versions', () => {
-    const workflow = `name: Test
-on: push
-env:
-  GIT_CONFIG_KEY_0: init.defaultBranch
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    concurrency:
-      group: \${{ github.workflow }}-\${{ github.ref }}-test
-      cancel-in-progress: true
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v5
-      - uses: codecov/codecov-action@v6
-`;
-    const originalError = console.error;
-    console.error = () => {};
+    const content = workflow({
+      steps: [
+        '      - uses: actions/setup-python@v5',
+        '      - uses: codecov/codecov-action@v6',
+      ].join('\n'),
+    });
 
-    try {
-      withWorkflow(workflow, (filePath) => {
-        assert.equal(checkWorkflow(filePath), 2);
-      });
-    } finally {
-      console.error = originalError;
-    }
+    assert.equal(countFailures(content), 2);
   });
 
   it('accepts a base_ref bound to any environment variable name', () => {
-    const workflow = `name: Test
-on: pull_request
-env:
-  GIT_CONFIG_KEY_0: init.defaultBranch
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    concurrency:
-      group: \${{ github.workflow }}-\${{ github.ref }}-test
-      cancel-in-progress: true
-    steps:
-      - uses: actions/checkout@v6
-      - name: Simulate fresh merge
-        env:
-          BASE_REF: \${{ github.base_ref }}
-        run: bash scripts/simulate-fresh-merge.sh
-`;
+    const content = workflow({
+      on: 'pull_request',
+      steps: [
+        '      - name: Simulate fresh merge',
+        '        env:',
+        '          BASE_REF: ${{ github.base_ref }}',
+        '        run: bash scripts/simulate-fresh-merge.sh',
+      ].join('\n'),
+    });
 
-    withWorkflow(workflow, (filePath) => {
+    withWorkflow(content, (filePath) => {
       assert.equal(checkWorkflow(filePath), 0);
     });
   });
 
   it('still rejects a base_ref spliced into a run body', () => {
-    const workflow = `name: Test
-on: pull_request
-env:
-  GIT_CONFIG_KEY_0: init.defaultBranch
-jobs:
-  test:
+    const content = workflow({
+      on: 'pull_request',
+      steps: '      - run: git fetch origin ${{ github.base_ref }}',
+    });
+
+    assert.ok(countFailures(content) > 0);
+  });
+
+  it('rejects a version scraped out of pyproject.toml with grep', () => {
+    // The exact command that shipped in python.yml until this pull request.
+    // pyproject.toml carries `version` under [project] and under [tool.scriv],
+    // so this grep wrote two lines into $GITHUB_OUTPUT and failed the step.
+    const content = workflow({
+      steps: [
+        '      - run: |',
+        `          CURRENT_VERSION=$(grep -Po '(?<=^version = ")[^"]*' pyproject.toml)`,
+        '          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT',
+      ].join('\n'),
+    });
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('rejects a crate name scraped out of Cargo.toml with head -1', () => {
+    // `head -1` is ordering-dependent, not table-aware: Cargo.toml repeats
+    // `name` under [[bin]] and [lib].
+    const content = workflow({
+      steps: `      - run: grep '^name' Cargo.toml | head -1 | cut -d'"' -f2`,
+    });
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('rejects a workflow with no pipeline-status gate', () => {
+    // A job killed by timeout-minutes is reported as cancelled, and a run whose
+    // only casualty is a cancelled job is filed under cancelled too, so without
+    // this gate the overrun fails nothing.
+    const content = workflow({
+      steps: '      - run: npm ci --ignore-scripts',
+    }).replace(/ {2}pipeline-status:[\s\S]*$/, '');
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('rejects a gate that has stopped watching a job', () => {
+    const content = `${workflow({
+      steps: '      - run: npm ci --ignore-scripts',
+    })}
+  drifted:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     concurrency:
-      group: \${{ github.workflow }}-\${{ github.ref }}-test
+      group: \${{ github.workflow }}-\${{ github.ref }}-drifted
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v6
-      - run: git fetch origin \${{ github.base_ref }}
+      - run: echo drifted
 `;
-    const originalError = console.error;
-    console.error = () => {};
-
-    try {
-      withWorkflow(workflow, (filePath) => {
-        assert.ok(checkWorkflow(filePath) > 0);
-      });
-    } finally {
-      console.error = originalError;
-    }
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('accepts the table-aware manifest readers', () => {
+    const content = workflow({
+      steps: [
+        '      - run: python scripts/read_manifest.py pyproject.toml --output current_version',
+        '      - run: node ../scripts/read-manifest.mjs Cargo.toml --field name',
+      ].join('\n'),
+    });
+
+    withWorkflow(content, (filePath) => {
+      assert.equal(checkWorkflow(filePath), 0);
+    });
+  });
+
+  it('leaves a commented-out manifest grep alone', () => {
+    const content = workflow({
+      steps: [
+        '      - run: |',
+        `          # Replaced grep -Po '(?<=^version = ")[^"]*' pyproject.toml`,
+        '          python scripts/read_manifest.py pyproject.toml --output version',
+      ].join('\n'),
+    });
+
+    withWorkflow(content, (filePath) => {
+      assert.equal(checkWorkflow(filePath), 0);
+    });
+  });
+});
+
+/**
+ * Build a two-job workflow whose `test` job varies only in how it relates to
+ * `lint`, so the fast-fail rule is the only thing a failure count can mean.
+ *
+ * @param {{needs: string, condition?: string}} parts
+ * @returns {string}
+ */
+function lintAndTest({ needs, condition = '' }) {
+  return [
+    'name: Test',
+    'on: push',
+    'permissions:',
+    '  contents: read',
+    'env:',
+    '  GIT_CONFIG_KEY_0: init.defaultBranch',
+    'jobs:',
+    '  lint:',
+    '    runs-on: ubuntu-latest',
+    '    timeout-minutes: 5',
+    '    concurrency:',
+    '      group: ${{ github.workflow }}-${{ github.ref }}-lint',
+    '      cancel-in-progress: true',
+    '    steps:',
+    '      - uses: actions/checkout@v6',
+    '  test:',
+    '    runs-on: ubuntu-latest',
+    '    timeout-minutes: 5',
+    '    concurrency:',
+    '      group: ${{ github.workflow }}-${{ github.ref }}-test',
+    '      cancel-in-progress: true',
+    `    needs: [${needs}]`,
+    condition,
+    '    steps:',
+    '      - uses: actions/checkout@v6',
+    '  pipeline-status:',
+    '    runs-on: ubuntu-latest',
+    '    timeout-minutes: 5',
+    '    concurrency:',
+    '      group: ${{ github.workflow }}-${{ github.ref }}-pipeline-status',
+    '      cancel-in-progress: true',
+    '    needs: [lint, test]',
+    '    steps:',
+    '      - run: bash scripts/check-pipeline-status.sh',
+    '',
+  ]
+    .filter((section) => section !== '')
+    .join('\n');
+}
+
+describe('fast-fail job ordering', () => {
+  it('rejects a test matrix that does not wait for lint', () => {
+    assert.equal(countFailures(lintAndTest({ needs: 'detect-changes' })), 1);
+  });
+
+  it('rejects a lint gate neutralised by !cancelled()', () => {
+    // `!cancelled()` overrides the implicit "all needs succeeded" rule, so
+    // `needs: [lint]` alone lets the matrix run after lint has already failed.
+    // The dependency is then decorative, which is worse than not having it:
+    // the graph claims a gate the run does not have.
+    assert.equal(
+      countFailures(
+        lintAndTest({
+          needs: 'lint',
+          condition: "    if: >-\n      !cancelled() && github.ref != 'x'",
+        })
+      ),
+      1
+    );
+  });
+
+  it('accepts a lint gate that restates the failure guard', () => {
+    assert.equal(
+      countFailures(
+        lintAndTest({
+          needs: 'lint',
+          condition:
+            "    if: >-\n      !cancelled() && !contains(needs.*.result, 'failure')",
+        })
+      ),
+      0
+    );
+  });
+
+  it('accepts a lint gate stated as an explicit result comparison', () => {
+    assert.equal(
+      countFailures(
+        lintAndTest({
+          needs: 'lint',
+          condition:
+            "    if: >-\n      !cancelled() && needs.lint.result == 'success'",
+        })
+      ),
+      0
+    );
+  });
+
+  it('accepts a plain dependency with no status function at all', () => {
+    // Without `always()` or `!cancelled()`, GitHub's own default already
+    // refuses to start the job when lint fails; nothing has to be restated.
+    assert.equal(countFailures(lintAndTest({ needs: 'lint' })), 0);
   });
 });

package/tests/unit/scripts/command-error-text.test.js

@@ -0,0 +1,83 @@
+/**
+ * Guard for the second half of the errexit change.
+ *
+ * Turning `errexit` on in loadCommandStream() makes a failed command reject —
+ * but `command-stream`'s rejection carries only
+ *
+ *   message : "Command failed with exit code 101"
+ *   code    : 101
+ *   stdout  : ""
+ *   stderr  : "error: crate version 0.10.11 is already uploaded\n"
+ *
+ * The diagnostic text a caller needs to branch on is in `stderr`, *not* in
+ * `message`. Three release scripts were written as
+ * `error.message.includes('already exists')`, which silently stops matching the
+ * moment the promise actually rejects. Left unfixed, enabling errexit would
+ * convert a harmless re-run over an already-published version into a red
+ * release job.
+ *
+ * `commandErrorText()` is the shared accessor those call sites use instead.
+ */
+
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+
+import { commandErrorText } from '../../../../scripts/use-module.mjs';
+
+describe('commandErrorText', () => {
+  it('finds text that command-stream puts in stderr rather than message', () => {
+    const error = Object.assign(
+      new Error('Command failed with exit code 101'),
+      {
+        code: 101,
+        stdout: '',
+        stderr: 'error: crate version 0.10.11 is already uploaded\n',
+      }
+    );
+
+    assert.equal(
+      error.message.includes('already uploaded'),
+      false,
+      'precondition: the message alone does not carry the reason'
+    );
+    assert.ok(commandErrorText(error).includes('already uploaded'));
+  });
+
+  it('includes stdout, which is where gh reports an existing release', () => {
+    const error = Object.assign(new Error('Command failed with exit code 1'), {
+      code: 1,
+      stdout: '{"message":"Reference already exists"}',
+      stderr: '',
+    });
+
+    assert.ok(commandErrorText(error).includes('already exists'));
+  });
+
+  it('keeps the message so an unrecognised failure is still describable', () => {
+    const error = Object.assign(new Error('Command failed with exit code 7'), {
+      code: 7,
+      stdout: '',
+      stderr: '',
+    });
+
+    assert.match(commandErrorText(error), /exit code 7/);
+  });
+
+  it('tolerates Buffer stdio, which is what capture returns without an encoding', () => {
+    const error = Object.assign(new Error('Command failed with exit code 1'), {
+      code: 1,
+      stdout: Buffer.from('already exists'),
+      stderr: Buffer.from(''),
+    });
+
+    assert.ok(commandErrorText(error).includes('already exists'));
+  });
+
+  it('does not throw on a non-command error, or on null', () => {
+    assert.equal(commandErrorText(new Error('plain')), 'plain');
+    assert.equal(commandErrorText(null), '');
+    assert.equal(commandErrorText(undefined), '');
+    // A thrown string is not an Error but must still be describable.
+    assert.equal(commandErrorText('boom'), 'boom');
+  });
+});