browser-commander 0.25.0 → 0.26.1

package/tests/unit/playwright-protocol-coverage.test.js

@@ -198,12 +198,15 @@ describe('Rust Playwright protocol bindings', () => {
     const installed = JSON.parse(
       fs.readFileSync(path.join(root, 'package.json'), 'utf8')
     ).version;
-    if (installed !== version) {
-      t.skip(
-        `playwright-core ${installed} is installed, the spec is ${version}`
-      );
-      return;
-    }
+    // A version mismatch is the drift this test exists to catch, so it fails
+    // rather than skips (issue #128: the same skip in the Puppeteer bindings
+    // test hid a stale manifest on every CI run).
+    assert.equal(
+      version,
+      installed,
+      `playwright-core ${installed} is installed, the spec is ${version}; ` +
+        'refresh rust/protocol/playwright/ as its README describes'
+    );
     // The driver validates every message against these schemes; one exists per
     // command (`<Interface><Command>Params`) and event (`<Interface><Event>Event`).
     const bundle = fs.readFileSync(

package/tests/unit/puppeteer-bindings-coverage.test.js

@@ -7,7 +7,8 @@
  * extracts from puppeteer-core's `lib/types.d.ts`. These tests fail when:
  *
  * - the committed wrappers differ from what the generator writes;
- * - the committed manifest differs from the installed puppeteer-core;
+ * - the committed manifest differs from the installed puppeteer-core,
+ *   including its version (a mismatch fails rather than skips);
  * - a public method or getter declared in `lib/types.d.ts` (own or inherited)
  *   has no typed entry point in Rust or Python.
  */
@@ -131,12 +132,15 @@ describe('Puppeteer bindings (Rust and Python)', () => {
       t.skip('puppeteer-core is not installed');
       return;
     }
-    if (installed.version !== manifest.version) {
-      t.skip(
-        `puppeteer-core ${installed.version} is installed, the manifest is ${manifest.version}`
-      );
-      return;
-    }
+    // A version mismatch is exactly the drift this test exists to catch (issue
+    // #128: puppeteer-core was upgraded to 25.12.0 while the manifest stayed
+    // at 25.10.0, and a skip here hid it), so it fails instead of skipping.
+    assert.equal(
+      manifest.version,
+      installed.version,
+      `puppeteer-core ${installed.version} is installed, the manifest is ${manifest.version}; ` +
+        'run node scripts/generate-puppeteer-bindings.mjs --update-api'
+    );
     const fresh = {
       package: 'puppeteer-core',
       version: installed.version,
@@ -149,6 +153,23 @@ describe('Puppeteer bindings (Rust and Python)', () => {
     );
   });
 
+  it('are read through virtual paths the TypeScript API can find on Windows', () => {
+    // TypeScript 7's virtual file system matches file names as exact keys, and
+    // the native compiler asks for them with forward slashes. Keys built with
+    // path.join on Windows (`D:\a\…\tsconfig.json`) were never found, so the
+    // project came back undefined (issue #128, run 37526767522).
+    const paths = extractor.virtualProjectPaths(
+      'D:\\a\\browser-commander\\browser-commander'
+    );
+    assert.deepEqual(paths, {
+      cwd: 'D:/a/browser-commander/browser-commander/experiments/puppeteer-api-virtual',
+      config:
+        'D:/a/browser-commander/browser-commander/experiments/puppeteer-api-virtual/tsconfig.json',
+      declaration:
+        'D:/a/browser-commander/browser-commander/experiments/puppeteer-api-virtual/types.d.ts',
+    });
+  });
+
   it('give every declared Puppeteer method a typed entry point', () => {
     const missing = [];
     let checked = 0;

package/tests/unit/scripts/bot-commit-attribution.test.js

@@ -0,0 +1,70 @@
+/**
+ * CI commits use the bot's documented no-reply address (issue #128).
+ *
+ * GitHub documents a user's no-reply address as
+ * `{user.id}+{user.login}@users.noreply.github.com`, and the actions/checkout
+ * README configures `41898282+github-actions[bot]@users.noreply.github.com`
+ * for commits pushed from a workflow. The three release paths here used the
+ * legacy `github-actions[bot]@users.noreply.github.com` instead.
+ *
+ * Checked on 2026-10-06: GitHub still links the legacy address to the bot
+ * (the commits API returns `author.login: github-actions[bot]` for release
+ * commits 9f8a552, cca988f, fda33e7 and d159aeb), so no release was ever
+ * unattributed here. The JS pipeline template switched for that reason
+ * (link-foundation/js-ai-driven-development-pipeline-template#144), which
+ * this repository could not reproduce. The test pins the documented form so
+ * the three packages agree with each other and with the template, without
+ * relying on GitHub continuing to resolve the undocumented one.
+ */
+
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { describe, it } from 'node:test';
+
+import { REPO_ROOT, repoPath } from '../../helpers/repo.js';
+
+const BOT_EMAIL = '41898282+github-actions[bot]@users.noreply.github.com';
+const UNPREFIXED = 'github-actions[bot]@users.noreply.github.com';
+
+// Every place that configures the commit author for CI, per language.
+const ROOTS = [
+  '.github/workflows',
+  'scripts',
+  'js/scripts',
+  'python/scripts',
+  'rust/scripts',
+];
+
+// Tracked files only: a local __pycache__ holds stale copies of the scripts.
+function trackedFiles(roots) {
+  return execFileSync('git', ['ls-files', '-z', '--', ...roots], {
+    cwd: REPO_ROOT,
+    encoding: 'utf8',
+  })
+    .split('\0')
+    .filter(Boolean);
+}
+
+describe('github-actions[bot] commit attribution', () => {
+  const files = trackedFiles(ROOTS);
+
+  it('configures the prefixed bot e-mail somewhere', () => {
+    assert.ok(
+      files.some((file) =>
+        readFileSync(repoPath(file), 'utf8').includes(BOT_EMAIL)
+      ),
+      `no file configures ${BOT_EMAIL}`
+    );
+  });
+
+  it('never configures the unprefixed bot e-mail', () => {
+    const offenders = files.filter((file) =>
+      readFileSync(repoPath(file), 'utf8')
+        .split(BOT_EMAIL)
+        .join('')
+        .includes(UNPREFIXED)
+    );
+    assert.deepEqual(offenders, []);
+  });
+});

package/tests/unit/scripts/check-duplication.test.js

@@ -0,0 +1,139 @@
+/**
+ * The duplication gate must print the clones it fails on, not the baseline
+ * (issue #128).
+ *
+ * With the console reporter, `jscpd --baseline … --fail-on-new-clones` lists
+ * every clone it finds. A passing run printed 272 "Clone found" blocks, about
+ * 840 lines, all of them clones the baseline already accepts. The one clone
+ * that fails a run was marked only by a `[NEW]` tag somewhere in that list.
+ */
+
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+
+import {
+  formatNewClones,
+  resolveJscpdCli,
+} from '../../../scripts/check-duplication.mjs';
+import { repoPath } from '../../helpers/repo.js';
+
+const SCRIPT = repoPath('js/scripts/check-duplication.mjs');
+
+function clone(first, second, isNew) {
+  const side = (name, start, end) => ({ name, start, end });
+  return {
+    format: 'javascript',
+    lines: second[2] - second[1] + 1,
+    isNew,
+    firstFile: side(...first),
+    secondFile: side(...second),
+  };
+}
+
+const REPORT = {
+  duplicates: [
+    clone(['README.md:javascript', 61, 92], ['src/README.md', 29, 60], false),
+    clone(['src/a.js', 21, 40], ['src/b,c.js', 3, 22], true),
+  ],
+};
+
+describe('formatNewClones', () => {
+  it('lists only the clones missing from the baseline', () => {
+    const text = formatNewClones(REPORT, { githubActions: false });
+    assert.match(text, /src\/a\.js:21-40 ~ src\/b,c\.js:3-22 \(20 lines\)/);
+    assert.doesNotMatch(text, /README/);
+  });
+
+  it('raises one error annotation per new clone, on the repository path', () => {
+    const text = formatNewClones(REPORT, {
+      githubActions: true,
+      cwd: repoPath('js'),
+      workspace: repoPath(),
+    });
+    const lines = text.trim().split('\n');
+    assert.equal(lines.length, 1);
+    assert.equal(
+      lines[0],
+      '::error file=js/src/a.js,line=21,endLine=40,title=New duplicated code::' +
+        '20 lines duplicate js/src/b,c.js:3-22. Extract the shared code, or ' +
+        'accept the clone with `npm run check:duplication:update`.'
+    );
+  });
+
+  it('strips the embedded-language suffix jscpd adds to Markdown code', () => {
+    const report = {
+      duplicates: [
+        clone(
+          ['README.md:javascript', 5, 9],
+          ['docs/x.md:markdown', 1, 5],
+          true
+        ),
+      ],
+    };
+    assert.match(
+      formatNewClones(report, {
+        githubActions: true,
+        cwd: repoPath('js'),
+        workspace: repoPath(),
+      }),
+      /^::error file=js\/README\.md,line=5,endLine=9,/
+    );
+  });
+});
+
+describe('check-duplication.mjs end to end', () => {
+  function run(cwd) {
+    return spawnSync(process.execPath, [SCRIPT], {
+      cwd,
+      encoding: 'utf8',
+      env: { ...process.env, GITHUB_ACTIONS: '', NO_COLOR: '1' },
+    });
+  }
+
+  it('is quiet about accepted clones and names a new one', (t) => {
+    if (!resolveJscpdCli()) {
+      return t.skip('jscpd is not installed; run npm ci in js/');
+    }
+    const fixture = fs.mkdtempSync(path.join(tmpdir(), 'check-duplication-'));
+    try {
+      fs.copyFileSync(
+        repoPath('js/.jscpd.json'),
+        path.join(fixture, '.jscpd.json')
+      );
+      const body = fs.readFileSync(repoPath('js/src/core/dialog-manager.js'));
+      fs.writeFileSync(path.join(fixture, 'one.js'), body);
+      fs.writeFileSync(path.join(fixture, 'two.js'), body);
+      const update = spawnSync(
+        process.execPath,
+        [
+          resolveJscpdCli(),
+          '.',
+          '--baseline',
+          '.jscpd-baseline.json',
+          '--update-baseline',
+          '--reporters',
+          'silent',
+        ],
+        { cwd: fixture, encoding: 'utf8' }
+      );
+      assert.equal(update.status, 0, update.stderr);
+
+      const accepted = run(fixture);
+      assert.equal(accepted.status, 0, accepted.stdout + accepted.stderr);
+      assert.doesNotMatch(accepted.stdout, /Clone found|one\.js/);
+      assert.match(accepted.stdout, /\d+ clones?, 0 new/);
+
+      fs.writeFileSync(path.join(fixture, 'three.js'), body);
+      const failed = run(fixture);
+      assert.equal(failed.status, 1, failed.stdout + failed.stderr);
+      assert.match(failed.stdout, /^New clone: \S+:\d+-\d+ ~ /m);
+      assert.match(failed.stdout, /clones, [1-9]\d* new/);
+    } finally {
+      fs.rmSync(fixture, { recursive: true, force: true });
+    }
+  });
+});

package/tests/unit/scripts/check-pipeline-status.test.js

@@ -6,9 +6,17 @@
  * `cancelled` as well - run 24045269874 of this repository is one such run on
  * `main`. scripts/check-pipeline-status.sh is the only thing that looks at
  * that, so these tests pin the readings it has to get right: a failure is
- * always an error, a cancellation off the default branch is a warning, a
- * cancellation on the default branch is an error unless a newer run has already
- * taken over the branch head.
+ * always an error, and a cancellation is an error unless a newer commit has
+ * overtaken the run *and* the cancelled job is one a newer run can cancel
+ * (`cancel-in-progress: true`). Anything else - a job that queues instead, a
+ * run still at the branch head, a value the gate cannot read - is a timeout or
+ * a manual stop that nothing else will report.
+ *
+ * The gate used to warn about every cancellation off the default branch, so a
+ * pull request whose test job hit `timeout-minutes` passed its gate (issue
+ * #128), and it excused a cancelled release writer on a superseded `main` run
+ * although `cancel-in-progress: false` means no newer run can cancel it.
+ *
  * Hosted-runner failures can report an undocumented abandoned result; it and
  * other unexpected/missing results must fail on every branch.
  *
@@ -16,27 +24,65 @@
  */
 
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
-import { describe, it } from 'node:test';
+import { after, before, describe, it } from 'node:test';
 
+import { readCancelInProgress } from '../../../../scripts/read-job-cancel-in-progress.mjs';
 import {
   BASH_AVAILABLE,
   REPO_ROOT,
+  readRepoText,
   repoPath,
   runBashScript,
 } from '../../helpers/repo.js';
 
 const SCRIPT = repoPath('scripts/check-pipeline-status.sh');
 
-function runGate(needs, env = {}, options = {}) {
-  return runBashScript(SCRIPT, [], {
-    cwd: options.cwd,
-    env: { NEEDS_JSON: JSON.stringify(needs), ...env },
-  });
-}
+const FIXTURE_WORKFLOW = `name: Fixture
+
+concurrency:
+  group: fixture-\${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  test:
+    runs-on: ubuntu-24.04
+    concurrency:
+      group: \${{ github.workflow }}-\${{ github.ref }}-test
+      cancel-in-progress: true # superseded runs stop here
+    steps:
+      - run: echo test
+
+  release:
+    runs-on: ubuntu-24.04
+    concurrency:
+      group: main-writer
+      cancel-in-progress: false
+    steps:
+      - run: echo release
+
+  dynamic:
+    runs-on: ubuntu-24.04
+    concurrency:
+      group: dynamic
+      cancel-in-progress: \${{ github.event_name == 'pull_request' }}
+    steps:
+      - run: echo dynamic
+
+  inherits:
+    runs-on: ubuntu-24.04
+    steps:
+      - run: echo inherits
+
+  group-only:
+    runs-on: ubuntu-24.04
+    concurrency: just-a-group
+    steps:
+      - run: echo group
+`;
 
 function results(map) {
   return Object.fromEntries(
@@ -44,11 +90,76 @@ function results(map) {
   );
 }
 
+describe('readCancelInProgress', () => {
+  const policy = readCancelInProgress(FIXTURE_WORKFLOW, [
+    'test',
+    'release',
+    'dynamic',
+    'inherits',
+    'group-only',
+    'absent',
+  ]);
+
+  it('reads a literal job-level value, comments and all', () => {
+    assert.equal(policy.get('test'), 'true');
+    assert.equal(policy.get('release'), 'false');
+  });
+
+  it('reports an expression as unknown instead of guessing', () => {
+    assert.equal(policy.get('dynamic'), 'unknown');
+  });
+
+  it('falls back to the workflow-level group, and to false for a bare group', () => {
+    assert.equal(policy.get('inherits'), 'false');
+    assert.equal(policy.get('group-only'), 'false');
+  });
+
+  it('says when the workflow has no such job', () => {
+    assert.equal(policy.get('absent'), 'missing');
+  });
+
+  it('says when neither the job nor the workflow has a group', () => {
+    const bare = 'name: Bare\non: push\njobs:\n  only:\n    runs-on: x\n';
+    assert.equal(readCancelInProgress(bare, ['only']).get('only'), 'none');
+  });
+});
+
 describe('check-pipeline-status.sh', { skip: !BASH_AVAILABLE }, () => {
+  let directory;
+  let workflowFile;
+
+  before(() => {
+    directory = mkdtempSync(path.join(tmpdir(), 'pipeline-status-'));
+    workflowFile = path.join(directory, 'fixture.yml');
+    writeFileSync(workflowFile, FIXTURE_WORKFLOW);
+  });
+
+  after(() => {
+    rmSync(directory, { force: true, recursive: true });
+  });
+
+  // GITHUB_WORKFLOW_REF is set when this suite itself runs in Actions; blank
+  // it so only what a test passes decides which workflow the gate reads.
+  function runGate(needs, env = {}, options = {}) {
+    return runBashScript(SCRIPT, [], {
+      cwd: options.cwd,
+      env: {
+        GITHUB_WORKFLOW_REF: '',
+        WORKFLOW_FILE: workflowFile,
+        BRANCH_NAME: 'main',
+        RUN_SHA: 'abc',
+        BRANCH_HEAD_SHA: 'abc',
+        NEEDS_JSON: JSON.stringify(needs),
+        ...env,
+      },
+    });
+  }
+
+  const superseded = { BRANCH_HEAD_SHA: 'def' };
+
   it('passes when every job succeeded or was legitimately skipped', () => {
     const { status, output } = runGate(
-      results({ lint: 'success', release: 'skipped' }),
-      { IS_MAIN: 'true', RUN_SHA: 'abc', BRANCH_HEAD_SHA: 'abc' }
+      results({ lint: 'success', release: 'skipped' })
     );
 
     assert.equal(status, 0);
@@ -60,19 +171,15 @@ describe('check-pipeline-status.sh', { skip: !BASH_AVAILABLE }, () => {
 
   it('fails on a failed job and names it', () => {
     const { status, output } = runGate(
-      results({ lint: 'failure', test: 'success' }),
-      { IS_MAIN: 'true', RUN_SHA: 'abc', BRANCH_HEAD_SHA: 'abc' }
+      results({ lint: 'failure', test: 'success' })
     );
 
     assert.equal(status, 1);
     assert.match(output, /::error::Pipeline failed\. Failing jobs: lint/);
   });
 
-  for (const env of [
-    { IS_MAIN: 'false' },
-    { IS_MAIN: 'true', RUN_SHA: 'abc', BRANCH_HEAD_SHA: 'def' },
-  ]) {
-    it(`fails on an abandoned runner job with IS_MAIN=${env.IS_MAIN}`, () => {
+  for (const env of [{}, superseded]) {
+    it(`fails on an abandoned runner job (branch head ${env.BRANCH_HEAD_SHA ?? 'abc'})`, () => {
       // Hosted-runner acquisition failure in run 37362314527 left the macOS
       // check cancelled, but GitHub sent "abandoned" to the needs context.
       const { status, output } = runGate(
@@ -98,58 +205,124 @@ describe('check-pipeline-status.sh', { skip: !BASH_AVAILABLE }, () => {
     });
   }
 
-  it('only warns about a cancellation off the default branch', () => {
+  it('fails on a cancellation in a pull request run that nothing overtook', () => {
+    // The old gate only warned off the default branch, so a pull request whose
+    // test job hit timeout-minutes passed its gate.
     const { status, output } = runGate(results({ test: 'cancelled' }), {
-      IS_MAIN: 'false',
-      RUN_SHA: 'abc',
-      BRANCH_HEAD_SHA: 'abc',
+      BRANCH_NAME: 'issue-128-feature',
     });
 
+    assert.equal(status, 1);
+    assert.match(output, /This run tests abc; issue-128-feature is at abc/);
+    assert.match(
+      output,
+      /test: the run is still the head of issue-128-feature/
+    );
+    assert.match(output, /::error::Pipeline has cancelled jobs: test\./);
+  });
+
+  it('fails on a cancellation at the default branch head', () => {
+    const { status, output } = runGate(results({ test: 'cancelled' }));
+
+    assert.equal(status, 1);
+    assert.match(output, /::error::Pipeline has cancelled jobs: test\./);
+  });
+
+  it('only warns when a newer commit overtook a job that cancels in progress', () => {
+    const { status, output } = runGate(
+      results({ test: 'cancelled' }),
+      superseded
+    );
+
     assert.equal(status, 0);
-    assert.match(output, /::warning::Cancelled jobs: test/);
+    assert.match(output, /This run tests abc; main is at def/);
+    assert.match(output, /test: it sets cancel-in-progress: true/);
+    assert.match(
+      output,
+      /::warning::Cancelled jobs in a superseded run: test\./
+    );
+    assert.doesNotMatch(output, /::error::/);
   });
 
-  it('fails on a cancellation on the default branch head', () => {
+  for (const [job, reason] of [
+    ['release', /it sets cancel-in-progress: false, so a newer run queues/],
+    ['dynamic', /cancel-in-progress is an expression or otherwise unreadable/],
+    ['inherits', /it sets cancel-in-progress: false, so a newer run queues/],
+    ['absent', /declares no job by that name/],
+  ]) {
+    it(`fails on a superseded run's cancelled ${job} job, which no supersede explains`, () => {
+      const { status, output } = runGate(
+        results({ test: 'cancelled', [job]: 'cancelled' }),
+        superseded
+      );
+
+      assert.equal(status, 1);
+      assert.match(output, reason);
+      assert.match(
+        output,
+        /::warning::Cancelled jobs in a superseded run: test\./
+      );
+      assert.match(
+        output,
+        new RegExp(`::error::Pipeline has cancelled jobs: ${job}\\.`)
+      );
+    });
+  }
+
+  it('fails closed when it cannot tell which workflow it is gating', () => {
     const { status, output } = runGate(results({ test: 'cancelled' }), {
-      IS_MAIN: 'true',
-      RUN_SHA: 'abc',
-      BRANCH_HEAD_SHA: 'abc',
+      ...superseded,
+      WORKFLOW_FILE: '',
     });
 
     assert.equal(status, 1);
-    assert.match(output, /::error::Pipeline has cancelled jobs on main: test/);
+    assert.match(output, /could not identify its workflow/);
   });
 
-  it('only warns when a newer commit already superseded the run', () => {
-    const { status, output } = runGate(results({ test: 'cancelled' }), {
-      IS_MAIN: 'true',
-      RUN_SHA: 'abc',
-      BRANCH_HEAD_SHA: 'def',
-    });
+  it('finds its workflow through GITHUB_WORKFLOW_REF, from the repository root', () => {
+    // ci-policy.yml's `check` job cancels in progress; `pipeline-status` reads
+    // it from the checkout whichever directory the step runs in.
+    const { status, output } = runGate(
+      results({ check: 'cancelled' }),
+      {
+        ...superseded,
+        WORKFLOW_FILE: '',
+        GITHUB_WORKFLOW_REF:
+          'link-foundation/browser-commander/.github/workflows/ci-policy.yml@refs/pull/129/merge',
+      },
+      { cwd: directory }
+    );
 
-    assert.equal(status, 0);
-    assert.match(output, /This run tests abc; main is at def/);
-    assert.match(output, /::warning::Cancelled jobs: test/);
+    assert.equal(status, 0, output);
+    assert.match(output, /check: it sets cancel-in-progress: true/);
   });
 
   it('fails rather than guesses when the branch head cannot be resolved', () => {
     // A missed supersede costs one noisy warning; a missed overrun on main
     // costs a silent failure, so the unresolvable case has to be the loud one.
-    const directory = mkdtempSync(path.join(tmpdir(), 'pipeline-status-'));
+    const { status, output } = runGate(
+      results({ test: 'cancelled' }),
+      { BRANCH_HEAD_SHA: '', GIT_REMOTE: 'no-such-remote' },
+      { cwd: directory }
+    );
 
-    try {
-      const { status, output } = runGate(
-        results({ test: 'cancelled' }),
-        { IS_MAIN: 'true', RUN_SHA: 'abc', BRANCH_HEAD_SHA: '' },
-        { cwd: directory }
-      );
+    assert.equal(status, 1);
+    assert.match(output, /assuming it is current/);
+    assert.match(output, /::error::Pipeline has cancelled jobs: test\./);
+  });
 
-      assert.equal(status, 1);
-      assert.match(output, /assuming it is current/);
-      assert.match(output, /::error::Pipeline has cancelled jobs on main/);
-    } finally {
-      rmSync(directory, { force: true, recursive: true });
-    }
+  it('prints the classification trace only when asked', () => {
+    const quiet = runGate(results({ test: 'cancelled' }), superseded);
+    const verbose = runGate(results({ test: 'cancelled' }), {
+      ...superseded,
+      PIPELINE_STATUS_VERBOSE: '1',
+    });
+
+    assert.doesNotMatch(quiet.output, /\[pipeline-status\]/);
+    assert.match(
+      verbose.output,
+      /\[pipeline-status\] cancelled test: cancel-in-progress=true, superseded=yes/
+    );
   });
 
   it('refuses to run without the job results', () => {
@@ -163,3 +336,42 @@ describe('check-pipeline-status.sh', { skip: !BASH_AVAILABLE }, () => {
     assert.match(result.stderr, /NEEDS_JSON is required/);
   });
 });
+
+describe('workflows that run the gate', () => {
+  const workflows = readdirSync(repoPath('.github/workflows'))
+    .filter((name) => name.endsWith('.yml'))
+    .map((name) => ({ name, source: readRepoText('.github/workflows', name) }))
+    .filter(({ source }) => source.includes('check-pipeline-status.sh'));
+
+  it('exist', () => {
+    assert.ok(workflows.length > 0);
+  });
+
+  for (const { name, source } of workflows) {
+    it(`${name} tells the gate which commit and branch the run tests`, () => {
+      // A pull request run's github.sha is a merge commit no branch points at,
+      // and github.ref_name is "129/merge"; the head commit and head branch are
+      // what a newer push moves.
+      assert.match(
+        source,
+        /RUN_SHA: \$\{\{ github\.event\.pull_request\.head\.sha \|\| github\.sha \}\}/
+      );
+      assert.match(
+        source,
+        /BRANCH_NAME: \$\{\{ github\.head_ref \|\| github\.ref_name \}\}/
+      );
+      assert.doesNotMatch(source, /IS_MAIN:/);
+    });
+
+    it(`${name} gives every job a cancel-in-progress the gate can read`, () => {
+      const jobsBlock = source.slice(source.search(/^jobs:\s*$/m));
+      const jobs = [
+        ...jobsBlock.matchAll(/^ {2}([A-Za-z_][\w.-]*):\s*$/gm),
+      ].map((match) => match[1]);
+      const unreadable = [...readCancelInProgress(source, jobs)]
+        .filter(([, value]) => !['true', 'false'].includes(value))
+        .map(([job, value]) => `${job}=${value}`);
+      assert.deepEqual(unreadable, []);
+    });
+  }
+});