browser-commander 0.17.0 → 0.17.2

package/.changeset/config.json

@@ -1,6 +1,7 @@
 {
   "$schema": "https://unpkg.com/@changesets/config@4.0.0/schema.json",
   "changelog": "@changesets/cli/changelog",
+  "format": "prettier",
   "commit": false,
   "fixed": [],
   "linked": [],

package/.jscpd-baseline.json

@@ -3,6 +3,7 @@
   "fingerprints": {
     "00d381dd611ae8ac": 1,
     "029a62ef1f48e856": 1,
+    "03241c1f33f40d14": 1,
     "038170e72e0af1f5": 1,
     "04b28d01d0bb47dc": 1,
     "04f605be138bc350": 1,
@@ -18,7 +19,7 @@
     "0caa402c4eae32d8": 1,
     "0fd23be8410c2c95": 1,
     "0fe4f3b5e5e939b3": 1,
-    "10b6201c3ca1fbe0": 1,
+    "1019ebbe7f07a5ad": 1,
     "1273365073edd790": 1,
     "1296adc3c3128048": 1,
     "13c4b58d3ea0719b": 1,
@@ -30,6 +31,7 @@
     "1ac9fbd87efdb313": 1,
     "1ad4dc7e19a77f68": 1,
     "1c1baf1bc8ea0eae": 1,
+    "1cbd39b416a2b94b": 1,
     "1d61f5c49f12d2dc": 1,
     "1ef570563d4e5a08": 1,
     "1f2104c950b12a30": 1,
@@ -51,6 +53,7 @@
     "2c0f8b5c6f28420b": 1,
     "2d2d6fd6c7c0f30d": 1,
     "2e70be24d2268673": 1,
+    "2f4c9810eae87d6f": 1,
     "2f9e15467cc2f12a": 1,
     "3101802d3ea65339": 1,
     "33357ce94e07cc4b": 1,
@@ -60,7 +63,6 @@
     "3a9f1672ecc1d55b": 1,
     "3adca52a3f04837c": 1,
     "3c1017def7b3216c": 1,
-    "3d7e17ad32108a7f": 1,
     "3da23cbee214a1a5": 1,
     "3dced48baf70eb36": 1,
     "3fa2ebbb416120f0": 1,
@@ -73,6 +75,7 @@
     "46e3f58cfb14a43a": 1,
     "4b0d3cc5c27227e7": 1,
     "4c3b94caa28045d0": 1,
+    "4e090d6bb30e6551": 1,
     "4f3c541b3f3e3f23": 1,
     "4fe5663c69a426cb": 1,
     "505d98bd14b63a6c": 1,
@@ -97,6 +100,7 @@
     "5ae9b1430fc38daf": 1,
     "602bfd129bba900e": 1,
     "608e1dd27138ec6f": 1,
+    "6098544c77ff17a2": 1,
     "60d0c58a01fc8746": 1,
     "61bcadcd8dc9f63e": 1,
     "63a3b672c8d8b50b": 1,
@@ -109,6 +113,7 @@
     "69d50e6f6a5f2ee9": 1,
     "6a7ed9ad3fc00a39": 1,
     "6af3c307939ef75e": 1,
+    "6b35b48512756192": 1,
     "6cd00d6b6a039022": 1,
     "6e2457cd3e1f69e7": 1,
     "6fa62e2642cc73c3": 1,
@@ -154,6 +159,7 @@
     "97c5a112fdde7be8": 1,
     "98cc22079feaa004": 1,
     "990d87f21678fa96": 1,
+    "9a72b1c2f22156ca": 1,
     "9b6ef4df04562546": 1,
     "9c055dfd90c369bf": 1,
     "9cb19f1b972e811e": 1,
@@ -196,6 +202,7 @@
     "be0900fb3e87164e": 1,
     "bf452b9431c092ad": 1,
     "c0b027bebd7bd737": 1,
+    "c189fe5122a7dc91": 1,
     "c2c155adbcb46f3c": 1,
     "c30737d62069fc02": 1,
     "c3c3569357673af8": 1,
@@ -203,15 +210,16 @@
     "c461a83b51eb7740": 1,
     "c9cf3c28bed33a5b": 1,
     "cbd444e9a6a9072e": 1,
-    "cc60029bf62920a3": 1,
     "cd49f39b43d14635": 1,
     "cebff7d1cc87f646": 1,
     "cf6116d195199f8a": 1,
     "cfd68135b744c27b": 1,
     "d097f41a6f43e634": 1,
+    "d0da8714c4b7de30": 1,
     "d17201496391f6cc": 1,
     "d17e8db5a2bab966": 1,
     "d1a4a8e6a523b752": 1,
+    "d1e5c2961267399a": 1,
     "d2ed3d02dd6a2d8c": 1,
     "d4eec99f58906a63": 1,
     "d6157a86fea41907": 1,
@@ -233,7 +241,6 @@
     "eb9a70c2a21094ff": 1,
     "ebd08637a2d7bcf3": 1,
     "ebe03c5f8c2f5147": 1,
-    "edccf5a595ab439f": 1,
     "ee19c8b9b332ee98": 1,
     "eeca0ccf8d821f21": 1,
     "ef2fc2e92ac07c6e": 1,
@@ -244,6 +251,7 @@
     "f46509ed693574df": 1,
     "f4bb6f4c83950fcd": 1,
     "f4bfa7e503443cd1": 1,
+    "f6678d6748e9c902": 1,
     "f67a07a611f39cb2": 1,
     "f911821aa7dda47f": 1,
     "f97bf515bfd95829": 1,

package/CHANGELOG.md

@@ -1,11 +1,36 @@
 # Changelog
 
+## 0.17.2
+
+### Patch Changes
+
+- 539ae64: Recover a release push that lost the race to `main` instead of failing the run.
+
+  The `main-writer` concurrency group serialises the three release jobs correctly,
+  but `actions/checkout` checks out `github.sha`, so every writer after the first
+  holds a tree one commit behind `main` and its push is rejected as
+  non-fast-forward. Serialisation buys ordering, not freshness. Every push to
+  `main` now rebases and retries — after classifying the rejection, because a
+  GH006/GH013 ruleset rejection also prints "rejected" and can never be rebased
+  away.
+
+## 0.17.1
+
+### Patch Changes
+
+- 43708ff: Make the release scripts fail when the commands they run fail.
+
+  `command-stream`'s `$` resolves rather than rejects on a non-zero exit, so every
+  `try/catch` around it in the release scripts was dead code. `loadCommandStream()`
+  now turns on `errexit`, the GitHub release tags are namespaced per language, and
+  the release job checks the formatting of the commit it is about to push.
+
 ## 0.17.0
 
 ### Minor Changes
 
 - Restore the release pipeline. `const { $ } = await use('command-stream')` returned `undefined` on the Node 24 the release jobs pin, because Node 23 added a synthetic `'module.exports'` named export for CommonJS namespaces that use-m's unwrapping does not recognise, so every JS and Rust release died on its first shell call with `TypeError: $ is not a function`. Dependencies now load through `scripts/use-module.mjs`, which detects that namespace shape and unwraps it. Manifest fields are read by TOML table through `scripts/read-manifest.mjs` instead of a line-anchored `grep`, which matched duplicate keys in other tables and wrote two lines into `$GITHUB_OUTPUT`. The duplication gate had `format` set to a reporter name, so jscpd scanned zero files and passed unconditionally; it now scans the tree against a recorded baseline.
-  
+
   Add the `fingerprint` subsystem, which removes the differences between a browser this library controls and one started by hand. `navigator.webdriver` stays false because the `AutomationControlled` Blink feature is disabled at launch, and `launchBrowser()` no longer passes the engine defaults a real Chrome does not carry. `resolveFingerprintProfile()` validates the 19 environment fields a page can read -- user agent and client hints, languages and locale, time zone, platform, cores, memory, screen, viewport, touch, WebGL strings, geolocation and the media preferences -- `createFingerprintPreset()` builds internally consistent Windows, macOS, Linux and Android machines, and `applyFingerprint()` installs a profile over CDP for both Playwright and Puppeteer. `FINGERPRINT_LIMITATIONS` documents what still cannot be made identical, and `relevantFingerprintLimitations()` narrows it to the entries a given profile and browser actually hit. The excluded defaults include Playwright's unconditional `--enable-unsafe-swiftshader`, which would otherwise give an automated browser a SwiftShader WebGL context on a machine where a hand-started Chrome has none.
 
 ## 0.16.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "browser-commander",
-  "version": "0.17.0",
+  "version": "0.17.2",
   "description": "Universal browser automation library that supports both Playwright and Puppeteer with a unified API",
   "main": "src/index.js",
   "type": "module",

package/scripts/check-release-format.mjs

@@ -0,0 +1,80 @@
+/**
+ * Guard the release commit against the formatting gate that never sees it.
+ *
+ * `version-and-commit.mjs` pushes the bump with `GITHUB_TOKEN`, and a push
+ * authenticated with `GITHUB_TOKEN` does not start a workflow run. Nothing
+ * therefore inspects the files the bump generated -- CHANGELOG.md,
+ * package.json, package-lock.json. When `changeset version` wrote a
+ * CHANGELOG.md that Prettier rejects, main's `format:check` went red and
+ * stayed red, because the only runs that could have reported it were the ones
+ * the push never triggered.
+ *
+ * This module has no side effects on import: the shell is passed in, so the
+ * behaviour is testable without running a release.
+ */
+
+export const FORMAT_CHECK_COMMAND = 'npm run format:check';
+
+export const FORMAT_FAILURE_TITLE = 'Release commit is not formatted';
+
+/**
+ * Build the annotation shown when the generated files fail the gate.
+ *
+ * A workflow command ends at the first newline, so the message is a single
+ * line and the captured output is printed separately.
+ * @returns {string}
+ */
+export function formatFailureAnnotation() {
+  return (
+    `::error title=${FORMAT_FAILURE_TITLE}::The version bump wrote files that ` +
+    'Prettier rejects. Pushing them would leave main failing format:check, ' +
+    'and the push does not trigger a run that would report it. Fix the ' +
+    'generator (see .changeset/config.json "format") rather than reformatting ' +
+    'by hand.'
+  );
+}
+
+/**
+ * Extract the reason a command-stream failure carries.
+ *
+ * With `errexit` on, `error.message` is only "Command failed with exit code
+ * N"; the diagnosis is in the captured streams.
+ * @param {unknown} error
+ * @returns {string}
+ */
+export function formatFailureDetails(error) {
+  const streams = error && typeof error === 'object' ? error : {};
+  return [streams.stdout, streams.stderr]
+    .map((stream) => String(stream ?? '').trim())
+    .filter(Boolean)
+    .join('\n');
+}
+
+/**
+ * Run the repository's formatting gate over the generated release commit.
+ *
+ * Rethrows on failure so the release stops before the push.
+ * @param {() => Promise<unknown>} runCheck
+ * @param {{log?: (message: string) => void, error?: (message: string) => void}} [console_]
+ * @returns {Promise<void>}
+ */
+export async function assertGeneratedFilesAreFormatted(
+  runCheck,
+  console_ = console
+) {
+  const log = console_.log ?? (() => {});
+  const error = console_.error ?? (() => {});
+
+  log('Checking that the release commit is formatted...');
+  try {
+    await runCheck();
+  } catch (failure) {
+    error(formatFailureAnnotation());
+    const details = formatFailureDetails(failure);
+    if (details) {
+      error(details);
+    }
+    throw failure;
+  }
+  log('Release commit is formatted');
+}

package/scripts/create-github-release.mjs

@@ -14,7 +14,9 @@
 
 import { readFileSync } from 'fs';
 
+import { releaseTag } from '../../scripts/release-tags.mjs';
 import {
+  commandErrorText,
   loadCommandStream,
   loadLinoArguments,
 } from '../../scripts/use-module.mjs';
@@ -49,7 +51,9 @@ if (!version || !repository) {
   process.exit(1);
 }
 
-const tag = `v${version}`;
+// `v<version>` is this package's namespace only; the crate uses `rust-v` and
+// the wheel `python-v`. See scripts/release-tags.mjs.
+const tag = releaseTag('js', version);
 
 console.log(`Creating GitHub release for ${tag}...`);
 
@@ -68,7 +72,14 @@ try {
     releaseNotes = match[0].replace(`## ${version}`, '').trim();
   }
 
+  // Falling back to a bare "Release <version>" body is a silent downgrade:
+  // the release still goes out and the job still passes, so this annotation is
+  // what makes an empty release body visible in the run summary.
   if (!releaseNotes) {
+    console.warn(
+      `::warning::Version ${version} has no "## ${version}" section in ` +
+        'CHANGELOG.md, releasing without notes'
+    );
     releaseNotes = `Release ${version}`;
   }
 
@@ -81,11 +92,21 @@ try {
     body: releaseNotes,
   });
 
-  await $`gh api repos/${repository}/releases -X POST --input -`.run({
-    stdin: payload,
-  });
-
-  console.log(`\u2705 Created GitHub release: ${tag}`);
+  try {
+    await $`gh api repos/${repository}/releases -X POST --input -`.run({
+      stdin: payload,
+    });
+    console.log(`\u2705 Created GitHub release: ${tag}`);
+  } catch (error) {
+    // Re-running a release over a tag that already has one is not a failure.
+    // The rust script has always tolerated it; the JS one did not need to
+    // while a failed `gh` call resolved instead of rejecting.
+    if (commandErrorText(error).includes('already exists')) {
+      console.log(`Release ${tag} already exists, skipping`);
+    } else {
+      throw error;
+    }
+  }
 } catch (error) {
   console.error('Error creating release:', error.message);
   process.exit(1);

package/scripts/version-and-commit.mjs

@@ -14,6 +14,12 @@
 
 import { readFileSync, appendFileSync, readdirSync } from 'fs';
 
+import { assertGeneratedFilesAreFormatted } from './check-release-format.mjs';
+
+import {
+  createGitRunner,
+  pushWithRebaseRetry,
+} from '../../scripts/push-with-rebase-retry.mjs';
 import {
   loadCommandStream,
   loadLinoArguments,
@@ -205,6 +211,16 @@ async function main() {
     console.log(`New version: ${newVersion}`);
     setOutput('new_version', newVersion);
 
+    // Re-run the formatting gate over the files the bump just generated.
+    //
+    // The release commit is pushed with GITHUB_TOKEN, and a GITHUB_TOKEN push
+    // does not start a workflow run, so no job ever inspects what the bump
+    // wrote. `changeset version` once produced a CHANGELOG.md that Prettier
+    // rejects; main's format:check went red and stayed red, because the only
+    // runs that could have caught it were the ones the push never triggered.
+    // Checking here stops a malformed release commit before it lands.
+    await assertGeneratedFilesAreFormatted(() => $`npm run format:check`);
+
     // Check if there are changes to commit
     const statusResult = await $`git status --porcelain`.run({ capture: true });
     const status = statusResult.stdout.trim();
@@ -220,8 +236,15 @@ async function main() {
       const escapedMessage = commitMessage.replace(/"/g, '\\"');
       await $`git commit -m "${escapedMessage}"`;
 
-      // Push directly to main
-      await $`git push origin main`;
+      // Push directly to main.
+      //
+      // The pre-emptive rebase above runs before the version bump, so it
+      // cannot cover a writer that lands between the bump and this push.
+      // pushWithRebaseRetry closes that window and, just as importantly,
+      // distinguishes a lost race from a branch-protection rejection instead
+      // of retrying one as if it were the other.
+      const git = await createGitRunner();
+      await pushWithRebaseRetry({ git, branch: 'main' });
 
       console.log('\u2705 Version bump committed and pushed to main');
       setOutput('version_committed', 'true');

package/tests/unit/scripts/cargo-lock-sync.test.js

@@ -0,0 +1,110 @@
+/**
+ * Guard for the lockfile half of RC-C.
+ *
+ * `rust/scripts/version-and-commit.mjs` writes the new version into
+ * Cargo.toml. Cargo.lock carries the workspace member's own version too, so a
+ * bump that touches only the manifest leaves the two disagreeing, and every
+ * job that builds the release commit with `cargo build --locked` fails with
+ * "the lock file needs to be updated but --locked was passed".
+ *
+ * The drift was invisible while RC-C was live: the release commit was never
+ * pushed, so main kept a Cargo.toml and a Cargo.lock that still agreed.
+ * Fixing RC-C is what makes this reachable.
+ *
+ * Analysis: dev/log/issues/83/pulls/84/analysis/root-causes.md, RC-C
+ */
+
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, it } from 'node:test';
+
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '../../../..');
+
+/**
+ * Read the version of a named package out of a Cargo.lock.
+ *
+ * The line separator is `\r?\n` because a Windows runner checks the file out
+ * with CRLF: `git config core.autocrlf` is `true` on GitHub's windows-latest
+ * image, so a pattern anchored on a bare `\n` matches nothing there and the
+ * lookup silently returns `undefined` -- a guard that passes on two operating
+ * systems and fails on the third for a reason that has nothing to do with what
+ * it guards.
+ *
+ * @param {string} lock
+ * @param {string} name
+ * @returns {string | undefined}
+ */
+function lockedVersion(lock, name) {
+  const pattern = new RegExp(
+    `\\[\\[package\\]\\]\\r?\\nname = "${name}"\\r?\\nversion = "([^"]+)"`
+  );
+  return pattern.exec(lock)?.[1];
+}
+
+describe('Cargo.lock stays in step with the release bump', () => {
+  const cargoToml = readFileSync(join(repoRoot, 'rust/Cargo.toml'), 'utf8');
+  const cargoLock = readFileSync(join(repoRoot, 'rust/Cargo.lock'), 'utf8');
+  const script = readFileSync(
+    join(repoRoot, 'rust/scripts/version-and-commit.mjs'),
+    'utf8'
+  );
+
+  it('records the manifest version in the lockfile today', () => {
+    const manifestVersion = /^\[package\][\s\S]*?^version = "([^"]+)"/m.exec(
+      cargoToml
+    )?.[1];
+    assert.ok(manifestVersion, 'Cargo.toml has no [package] version');
+    assert.equal(
+      lockedVersion(cargoLock, 'browser-commander'),
+      manifestVersion,
+      'a build with --locked would refuse this tree'
+    );
+  });
+
+  it('reads a lockfile that was checked out with CRLF line endings', () => {
+    const crlf = cargoLock.replace(/\r?\n/g, '\r\n');
+    assert.equal(
+      lockedVersion(crlf, 'browser-commander'),
+      lockedVersion(cargoLock, 'browser-commander'),
+      'the same lockfile must read the same on a Windows checkout'
+    );
+  });
+
+  it('refreshes the lockfile as part of the bump', () => {
+    assert.match(
+      script,
+      /cargo update --workspace/,
+      'bumping Cargo.toml without refreshing Cargo.lock breaks --locked builds'
+    );
+  });
+
+  it('refreshes the lockfile after the manifest, not before', () => {
+    const bump = script.indexOf('updateCargoToml(newVersion)');
+    const refresh = script.indexOf('cargo update --workspace');
+    assert.ok(bump > 0 && refresh > 0);
+    assert.ok(
+      bump < refresh,
+      'refreshing before the bump would re-lock the old version'
+    );
+  });
+
+  it('stages the lockfile in the release commit', () => {
+    const add = /git add -A ([^`]+)`/.exec(script)?.[1] ?? '';
+    assert.ok(
+      add.split(/\s+/).includes('Cargo.lock'),
+      `Cargo.lock is refreshed but never committed (staged: ${add.trim()})`
+    );
+  });
+
+  it('is what the release job later builds with --locked', () => {
+    // If the workflow stopped passing --locked the drift would go unnoticed
+    // again, so the guard is only meaningful while this flag is there.
+    const workflow = readFileSync(
+      join(repoRoot, '.github/workflows/rust.yml'),
+      'utf8'
+    );
+    assert.match(workflow, /cargo build --locked/);
+  });
+});

package/tests/unit/scripts/changelog-collection-order.test.js

@@ -0,0 +1,144 @@
+/**
+ * Guard for RC-I: collecting the changelog before the version bump.
+ *
+ * Both manual-release jobs used to collect fragments in a workflow step that
+ * ran ahead of the bump, and both named the section wrongly as a result:
+ *
+ *   rust.yml    `node scripts/collect-changelog.mjs` reads the version out of
+ *               Cargo.toml, which at that point still held the version that
+ *               was already released, so the notes were filed under it and
+ *               the version being released got none.
+ *   python.yml  `scriv collect --version "$BUMP_TYPE"`. `--version` names the
+ *               new changelog section rather than selecting a bump, so a
+ *               release wrote a section titled "patch".
+ *
+ * Either way the release notes went missing: create-github-release looks for
+ * the version it is releasing and falls back to a bare "Release <version>".
+ *
+ * Collection now happens inside the version-and-commit scripts, after the
+ * bump has computed the version. These assertions are on the workflows,
+ * because that is where the ordering lived.
+ *
+ * Analysis: dev/log/issues/83/pulls/84/analysis/root-causes.md
+ * Reproduction: experiments/scriv-collect-version/run.sh
+ */
+
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, it } from 'node:test';
+
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '../../../..');
+
+/**
+ * Read a workflow with its comment lines removed.
+ *
+ * The comments explain the very mistakes these assertions look for, so
+ * matching against the raw file would find the explanation and report the bug
+ * as still present.
+ * @param {string} name
+ * @returns {string}
+ */
+function workflow(name) {
+  return readFileSync(join(repoRoot, '.github/workflows', name), 'utf8')
+    .split('\n')
+    .filter((line) => !/^\s*#/.test(line))
+    .join('\n');
+}
+
+describe('changelog fragments are collected after the version bump', () => {
+  it('never passes a bump type where a version name is expected', () => {
+    // `scriv collect --version` is documented as "The version name to use for
+    // this entry", so "$BUMP_TYPE" lands in the changelog verbatim.
+    assert.doesNotMatch(
+      workflow('python.yml'),
+      /scriv collect --version "\$BUMP_TYPE"/,
+      'scriv would head the release section with the word "patch"'
+    );
+  });
+
+  it('has no workflow step that collects ahead of the bump', () => {
+    for (const [name, collector] of [
+      ['rust.yml', 'collect-changelog.mjs'],
+      ['python.yml', 'scriv collect'],
+    ]) {
+      const content = workflow(name);
+      const collect = content.indexOf(collector);
+      if (collect < 0) {
+        continue;
+      }
+      const bump = content.indexOf('name: Version and commit');
+      assert.ok(
+        bump < 0 || collect > bump,
+        `${name} collects the changelog before the bump names the version`
+      );
+    }
+  });
+
+  it('collects inside the scripts that know the new version', () => {
+    const rust = readFileSync(
+      join(repoRoot, 'rust/scripts/version-and-commit.mjs'),
+      'utf8'
+    );
+    assert.match(rust, /updateChangelog\('\.', newVersion, fragments\)/);
+
+    const python = readFileSync(
+      join(repoRoot, 'python/scripts/version_and_commit.py'),
+      'utf8'
+    );
+    assert.match(python, /collect_changelog\(new_version, project_root\)/);
+  });
+
+  it('orders collection after the bump inside those scripts', () => {
+    const rust = readFileSync(
+      join(repoRoot, 'rust/scripts/version-and-commit.mjs'),
+      'utf8'
+    );
+    assert.ok(
+      rust.indexOf('const newVersion = await findNextAvailableVersion') <
+        rust.indexOf('collectFragments()')
+    );
+
+    const python = readFileSync(
+      join(repoRoot, 'python/scripts/version_and_commit.py'),
+      'utf8'
+    );
+    assert.ok(
+      python.indexOf('new_version = bump_version(') <
+        python.indexOf('collect_changelog(new_version')
+    );
+  });
+
+  it('writes headings at the level the release scripts read', () => {
+    // scriv defaults to level 1 while create_github_release.py extracts from
+    // `## <version>`, so the two could never meet.
+    const pyproject = readFileSync(
+      join(repoRoot, 'python/pyproject.toml'),
+      'utf8'
+    );
+    assert.match(pyproject, /^md_header_level = "2"$/m);
+
+    const release = readFileSync(
+      join(repoRoot, 'python/scripts/create_github_release.py'),
+      'utf8'
+    );
+    assert.match(release, /rf"\^## \{re\.escape\(version\)\}/);
+  });
+
+  it('says so in the run summary when the notes are missing anyway', () => {
+    // The fallback body is a silent downgrade: the release still goes out and
+    // the job still passes.
+    for (const path of [
+      'js/scripts/create-github-release.mjs',
+      'rust/scripts/create-github-release.mjs',
+      'python/scripts/create_github_release.py',
+    ]) {
+      assert.match(
+        readFileSync(join(repoRoot, path), 'utf8'),
+        /::warning::/,
+        `${path} drops the release notes without a word`
+      );
+    }
+  });
+});