browser-commander 0.26.0 → 0.26.1

package/tests/unit/scripts/ci-workflow-policy.test.js

@@ -36,19 +36,21 @@ function workflow({ on = 'push', preamble = '', job = 'test', steps }) {
     '  GIT_CONFIG_KEY_0: init.defaultBranch',
     'jobs:',
     `  ${job}:`,
-    '    runs-on: ubuntu-latest',
+    '    runs-on: ubuntu-24.04',
     '    timeout-minutes: 5',
     '    concurrency:',
     `      group: \${{ github.workflow }}-\${{ github.ref }}-${job}`,
     '      cancel-in-progress: true',
     '    steps:',
     '      - uses: actions/checkout@v6',
+    '        with:',
+    '          persist-credentials: false',
     steps,
     // Every workflow has to end in the gate that reads the other jobs'
     // results, so the scaffolding carries one; the gate's own tests are in
     // ci-timeout-budgets.test.js.
     '  pipeline-status:',
-    '    runs-on: ubuntu-latest',
+    '    runs-on: ubuntu-24.04',
     '    timeout-minutes: 5',
     '    concurrency:',
     '      group: ${{ github.workflow }}-${{ github.ref }}-pipeline-status',
@@ -100,9 +102,11 @@ concurrency:
   cancel-in-progress: true
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - run: npm install
       - run: echo "\${{ github.head_ref }}"
       - uses: codecov/codecov-action@v6
@@ -163,6 +167,82 @@ jobs:
     assert.equal(countFailures(content), 1);
   });
 
+  it('rejects the moving ubuntu-latest label in runs-on and in a matrix', () => {
+    // ubuntu-latest moves to Ubuntu 26.04 from 2026-10-19
+    // (actions/runner-images#14748), and every job using it carried that
+    // migration warning in issue #128's runs.
+    const content = workflow({
+      preamble: '',
+      steps: [
+        '    strategy:',
+        '      matrix:',
+        '        os: [ubuntu-latest, windows-latest]',
+      ].join('\n'),
+    }).replace('    runs-on: ubuntu-24.04', '    runs-on: ubuntu-latest');
+
+    assert.equal(countFailures(content), 2);
+  });
+
+  it('rejects a checker that npx fetches at whatever version is newest', () => {
+    // `npx --yes -p secretlint` resolves the latest release on every run, so a
+    // new rule set could fail a pull request that changed nothing it scans.
+    const content = workflow({
+      steps: [
+        '      - run: npx --yes -p secretlint -p @secretlint/secretlint-rule-preset-recommend secretlint "**/*"',
+        '      - run: npx --yes -p secretlint@13.0.7 -p @secretlint/secretlint-rule-preset-recommend@13.0.7 secretlint "**/*"',
+      ].join('\n'),
+    });
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('rejects a cargo audit that passes on advisory warnings', () => {
+    // Without --deny warnings, an unmaintained, unsound or yanked crate prints
+    // "warning: 1 allowed warning found" and exits 0 (issue #128,
+    // reproductions/cargo-audit-deny-warnings.log).
+    const content = workflow({
+      steps: [
+        '      - run: cargo audit --file Cargo.lock',
+        '      - run: cargo audit --file Cargo.lock --deny warnings',
+      ].join('\n'),
+    });
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('rejects a checkout that leaves the job token in .git/config', () => {
+    // actions/checkout persists the token unless told not to, so any later
+    // step - an install script, an artifact upload of the workspace - can
+    // read it. zizmor reports this as artipacked at low confidence, below the
+    // floor the audit ran with, so 38 checkouts did it unreported (#128).
+    const content = workflow({ steps: '' }).replace(
+      '        with:\n          persist-credentials: false\n',
+      ''
+    );
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('rejects a persisted credential in a job that does not write to main', () => {
+    const content = workflow({ steps: '' }).replace(
+      'persist-credentials: false',
+      'persist-credentials: true'
+    );
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('accepts a persisted credential in a main-writer job that pushes', () => {
+    const content = workflow({ job: 'release', steps: '' })
+      .replace(
+        'group: ${{ github.workflow }}-${{ github.ref }}-release\n      cancel-in-progress: true',
+        'group: main-writer-${{ github.repository }}-main\n      cancel-in-progress: false'
+      )
+      .replace('persist-credentials: false', 'persist-credentials: true');
+
+    assert.equal(countFailures(content), 0);
+  });
+
   it('accepts a base_ref bound to any environment variable name', () => {
     const content = workflow({
       on: 'pull_request',
@@ -229,7 +309,7 @@ jobs:
       steps: '      - run: npm ci --ignore-scripts',
     })}
   drifted:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     concurrency:
       group: \${{ github.workflow }}-\${{ github.ref }}-drifted
@@ -286,15 +366,17 @@ function lintAndTest({ needs, condition = '' }) {
     '  GIT_CONFIG_KEY_0: init.defaultBranch',
     'jobs:',
     '  lint:',
-    '    runs-on: ubuntu-latest',
+    '    runs-on: ubuntu-24.04',
     '    timeout-minutes: 5',
     '    concurrency:',
     '      group: ${{ github.workflow }}-${{ github.ref }}-lint',
     '      cancel-in-progress: true',
     '    steps:',
     '      - uses: actions/checkout@v6',
+    '        with:',
+    '          persist-credentials: false',
     '  test:',
-    '    runs-on: ubuntu-latest',
+    '    runs-on: ubuntu-24.04',
     '    timeout-minutes: 5',
     '    concurrency:',
     '      group: ${{ github.workflow }}-${{ github.ref }}-test',
@@ -303,8 +385,10 @@ function lintAndTest({ needs, condition = '' }) {
     condition,
     '    steps:',
     '      - uses: actions/checkout@v6',
+    '        with:',
+    '          persist-credentials: false',
     '  pipeline-status:',
-    '    runs-on: ubuntu-latest',
+    '    runs-on: ubuntu-24.04',
     '    timeout-minutes: 5',
     '    concurrency:',
     '      group: ${{ github.workflow }}-${{ github.ref }}-pipeline-status',

package/tests/unit/scripts/command-stream-errexit.test.js

@@ -23,20 +23,18 @@
  */
 
 import assert from 'node:assert/strict';
+import { readdirSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { describe, it } from 'node:test';
+import { fileURLToPath } from 'node:url';
 
 import {
+  isUseMReachable,
   loadCommandStream,
   USE_M_URL,
 } from '../../../../scripts/use-module.mjs';
 
-async function hasNetwork() {
-  try {
-    return (await fetch(USE_M_URL, { method: 'HEAD' })).ok;
-  } catch {
-    return false;
-  }
-}
+const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), '../../../..');
 
 /**
  * Load command-stream, or a reason to skip.
@@ -51,7 +49,7 @@ async function load(t) {
     t.skip('use-m cannot import absolute paths on Windows');
     return null;
   }
-  if (!(await hasNetwork())) {
+  if (!(await isUseMReachable())) {
     t.skip(`${USE_M_URL} is unreachable, so use-m cannot be evaluated`);
     return null;
   }
@@ -70,6 +68,20 @@ async function load(t) {
   }
 }
 
+/**
+ * A test that runs commands through `$`, skipped when it cannot be loaded.
+ * @param {string} name
+ * @param {(shell: (...args: any[]) => Promise<any>) => Promise<void>} body
+ */
+function itWithShell(name, body) {
+  it(name, async (t) => {
+    const $ = (await load(t))?.$;
+    if ($) {
+      await body($);
+    }
+  });
+}
+
 describe('loadCommandStream makes a failed command fail', () => {
   it('turns errexit on, so the release scripts catch what they try to catch', async (t) => {
     const cs = await load(t);
@@ -85,48 +97,78 @@ describe('loadCommandStream makes a failed command fail', () => {
     );
   });
 
-  it('rejects on a non-zero exit and reports the exit code', async (t) => {
-    const cs = await load(t);
-    if (!cs) {
-      return;
-    }
-    const { $ } = cs;
-
-    await assert.rejects(
-      () => $`exit 7`,
-      (error) => {
-        assert.equal(error.code, 7, 'the exit code must survive on the error');
-        return true;
-      },
-      'a command exiting 7 must reject, not resolve'
-    );
-  });
-
-  it('still resolves with stdout on success', async (t) => {
-    const cs = await load(t);
-    if (!cs) {
-      return;
+  itWithShell(
+    'rejects on a non-zero exit and reports the exit code',
+    async ($) => {
+      // A real process, as in the release scripts. command-stream's virtual
+      // `exit` builtin would also reject, but it writes "Command failed with
+      // exit code 7" to stderr on top, which surfaced as a stray line at the end
+      // of every CI test log (issue #128).
+      await assert.rejects(
+        () => $`sh -c "exit 7"`,
+        (error) => {
+          assert.equal(
+            error.code,
+            7,
+            'the exit code must survive on the error'
+          );
+          return true;
+        },
+        'a command exiting 7 must reject, not resolve'
+      );
     }
-    const { $ } = cs;
+  );
 
+  itWithShell('still resolves with stdout on success', async ($) => {
     // errexit must not turn every command into a throw: the success path is
     // what the release scripts read version numbers and git status out of.
     const result = await $`echo errexit-ok`;
     assert.match(String(result.stdout), /errexit-ok/);
   });
 
-  it('reports a non-zero exit for the exact command that broke the Rust release', async (t) => {
-    const cs = await load(t);
-    if (!cs) {
-      return;
+  itWithShell(
+    'reports a non-zero exit for the exact command that broke the Rust release',
+    async ($) => {
+      // `git diff --cached --quiet` exits 1 when there ARE staged changes.
+      // rust/scripts/version-and-commit.mjs relied on that becoming a rejection
+      // and, because it did not, reported "No changes to commit" after staging
+      // two modified files. `false` stands in for it here so the test needs no
+      // git fixture; the contract under test is identical.
+      await assert.rejects(() => $`false`, 'a command exiting 1 must reject');
     }
-    const { $ } = cs;
+  );
+});
+
+describe('command-stream quotes interpolated values itself', () => {
+  // `${value}` in a `$` template is passed through as one argument, quoted by
+  // the library. Escaping by hand on top of that is not a no-op: inside
+  // `"${…}"` the backslashes survive into the argument. CodeQL flagged the
+  // hand escaping in js/scripts/version-and-commit.mjs
+  // (js/incomplete-sanitization, issue #128); this pins why it was removed.
+  const message = 'a "quoted" $HOME `id` back\\slash';
+
+  itWithShell('passes a bare interpolation through unchanged', async ($) => {
+    const result = await $({ mirror: false })`printf '%s' ${message}`;
+    assert.equal(String(result.stdout), message);
+  });
 
-    // `git diff --cached --quiet` exits 1 when there ARE staged changes.
-    // rust/scripts/version-and-commit.mjs relied on that becoming a rejection
-    // and, because it did not, reported "No changes to commit" after staging
-    // two modified files. `false` stands in for it here so the test needs no
-    // git fixture; the contract under test is identical.
-    await assert.rejects(() => $`false`, 'a command exiting 1 must reject');
+  itWithShell('keeps hand-added backslashes inside quotes', async ($) => {
+    // What the removed code produced: `"` escaped, nothing else.
+    const handEscaped = 'a \\"quoted\\" $HOME `id` back\\slash';
+    const result = await $({ mirror: false })`printf '%s' "${handEscaped}"`;
+    assert.notEqual(String(result.stdout), message);
+  });
+
+  it('no release script escapes quotes by hand before interpolating', () => {
+    const offenders = ['js/scripts', 'rust/scripts']
+      .flatMap((dir) =>
+        readdirSync(join(REPO_ROOT, dir))
+          .filter((name) => name.endsWith('.mjs'))
+          .map((name) => join(dir, name))
+      )
+      .filter((file) =>
+        /\.replace\(\/"\/g/.test(readFileSync(join(REPO_ROOT, file), 'utf8'))
+      );
+    assert.deepEqual(offenders, []);
   });
 });

package/tests/unit/scripts/e2e-suite-coverage.test.js

@@ -0,0 +1,174 @@
+/**
+ * Every real-browser suite is run by some workflow, or says why it is not.
+ *
+ * An end-to-end suite skips itself without `RUN_E2E` (or, in Rust, is marked
+ * `#[ignore]`), and a skipped suite exits zero. So a suite that no workflow
+ * opts into is not a failing check: it is no check at all, and CI stays green
+ * while it rots. Issue #128 found ten of them across the three languages.
+ *
+ * This test lists the suites on disk and fails when one is neither invoked by
+ * a workflow nor named in MANUAL_ONLY with a reason a reviewer can judge.
+ * "Invoked" means the suite's file (JavaScript, Python) or test target (Rust,
+ * together with `--ignored`) appears in a command a workflow runs, directly or
+ * through the js/package.json script the command calls. Comments and `paths:`
+ * filters do not count, and neither does a whole-directory run such as
+ * `pytest tests/`, which collects the suites only to skip them.
+ */
+
+import assert from 'node:assert/strict';
+import { readdirSync } from 'node:fs';
+import { describe, it } from 'node:test';
+
+import { readRepoText, repoPath } from '../../helpers/repo.js';
+
+/**
+ * Suites no workflow can run, keyed by repository path. The reason is the
+ * point: it is what a reviewer weighs when deciding whether the gap is real.
+ */
+const MANUAL_ONLY = {
+  'js/tests/e2e/google-signin-probe.e2e.test.js':
+    "Drives Google's live sign-in page, so a CI run would depend on a third-party site and risk tripping its abuse detection from a shared runner IP; it is opt-in through RUN_GOOGLE_PROBE.",
+};
+
+function listFiles(directory, pattern) {
+  return readdirSync(repoPath(directory))
+    .filter((name) => pattern.test(name))
+    .sort()
+    .map((name) => `${directory}/${name}`);
+}
+
+function baseName(file) {
+  return file.slice(file.lastIndexOf('/') + 1);
+}
+
+const SUITES = [
+  ...listFiles('js/tests/e2e', /\.e2e\.test\.js$/),
+  ...listFiles('python/tests/e2e', /^test_.*\.py$/),
+  ...listFiles('rust/tests', /\.rs$/).filter((file) =>
+    /#\[ignore/.test(readRepoText(file))
+  ),
+];
+
+/**
+ * The commands a workflow runs: comment lines dropped, shell line
+ * continuations joined so one command is one line, and the `on:` trigger
+ * section (whose `paths:` filters list file names) left out.
+ */
+function workflowCommands(text) {
+  const jobsStart = text.indexOf('\njobs:\n');
+
+  return (jobsStart === -1 ? '' : text.slice(jobsStart))
+    .replace(/\\\n\s*/g, ' ')
+    .split('\n')
+    .filter((line) => !/^\s*#/.test(line))
+    .join('\n');
+}
+
+const COMMANDS = readdirSync(repoPath('.github/workflows'))
+  .filter((name) => name.endsWith('.yml'))
+  .sort()
+  .map((name) => ({
+    workflow: name,
+    commands: workflowCommands(readRepoText('.github/workflows', name)),
+  }));
+
+const PACKAGE_SCRIPTS = JSON.parse(readRepoText('js/package.json')).scripts;
+
+function tokens(command) {
+  return command.split(/[\s'"]+/).filter(Boolean);
+}
+
+/** The js/package.json scripts whose command names this file. */
+function scriptsRunning(file) {
+  const relative = file.replace(/^js\//, '');
+
+  return Object.entries(PACKAGE_SCRIPTS)
+    .filter(([, command]) => tokens(command).includes(relative))
+    .map(([name]) => name);
+}
+
+/** Where the suite is run, as "<workflow>: <how>" strings. */
+function findRunners(file) {
+  const name = baseName(file);
+  const runners = [];
+
+  for (const { workflow, commands } of COMMANDS) {
+    const lines = commands.split('\n');
+
+    if (file.startsWith('rust/')) {
+      const target = name.replace(/\.rs$/, '');
+      const runsIt = lines.some((line) => {
+        const words = tokens(line);
+        return (
+          words.includes('--ignored') &&
+          words.some(
+            (word, index) => word === '--test' && words[index + 1] === target
+          )
+        );
+      });
+      if (runsIt) {
+        runners.push(`${workflow}: --test ${target} --ignored`);
+      }
+      continue;
+    }
+
+    if (
+      lines.some((line) =>
+        tokens(line).some((word) => word === name || word.endsWith(`/${name}`))
+      )
+    ) {
+      runners.push(`${workflow}: ${name}`);
+    }
+
+    for (const script of scriptsRunning(file)) {
+      const runsScript = lines.some((line) =>
+        tokens(line).some(
+          (word, index, words) =>
+            word === script &&
+            words[index - 1] === 'run' &&
+            words[index - 2] === 'npm'
+        )
+      );
+      if (runsScript) {
+        runners.push(`${workflow}: npm run ${script}`);
+      }
+    }
+  }
+
+  return runners;
+}
+
+describe('end-to-end suite coverage', () => {
+  it('finds the suites to check', () => {
+    for (const language of ['js/', 'python/', 'rust/']) {
+      assert.ok(
+        SUITES.some((file) => file.startsWith(language)),
+        `no ${language} end-to-end suites found; the file patterns are stale`
+      );
+    }
+  });
+
+  it('runs every end-to-end suite in some workflow, or says why not', () => {
+    const unrun = SUITES.filter(
+      (file) => !(file in MANUAL_ONLY) && findRunners(file).length === 0
+    );
+
+    assert.deepEqual(
+      unrun,
+      [],
+      'these suites skip in every workflow, so CI is green whether or not they pass; run them in a workflow (.github/workflows/parity.yml) or add them to MANUAL_ONLY with a reason'
+    );
+  });
+
+  it('keeps MANUAL_ONLY to suites that exist and that no workflow runs', () => {
+    for (const [file, reason] of Object.entries(MANUAL_ONLY)) {
+      assert.ok(SUITES.includes(file), `${file} is not an end-to-end suite`);
+      assert.ok(reason.length > 40, `${file} needs a real reason`);
+      assert.deepEqual(
+        findRunners(file),
+        [],
+        `${file} is run by a workflow; drop it from MANUAL_ONLY`
+      );
+    }
+  });
+});

package/tests/unit/scripts/github-actions-log.test.js

@@ -0,0 +1,99 @@
+/**
+ * Contributor-authored text must not become a workflow command.
+ *
+ * GitHub Actions reads any log line that starts with `::name::` or `##[name]`
+ * as a command, so a changeset that quotes `::error::` printed bare raises a
+ * fake annotation — and `::add-mask::`, `::stop-commands::` or `::debug::` can
+ * change what the rest of the log shows. Issue #128 adopts the
+ * link-foundation templates' guard (rust template issue #173).
+ */
+
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { describe, it } from 'node:test';
+
+import { printUntrusted } from '../../../../scripts/github-actions-log.mjs';
+import { repoPath } from '../../helpers/repo.js';
+
+function capturePrint(value, options = {}) {
+  let output = '';
+  printUntrusted(value, {
+    stream: { write: (chunk) => (output += chunk) },
+    ...options,
+  });
+  return output;
+}
+
+describe('github-actions-log printUntrusted', () => {
+  it('prints local output unchanged', () => {
+    assert.equal(
+      capturePrint('quoted ::error:: text', { githubActions: false }),
+      'quoted ::error:: text\n'
+    );
+  });
+
+  it('brackets the whole value while GitHub interprets commands', () => {
+    const output = capturePrint('first\n::error::not a real annotation', {
+      githubActions: true,
+      tokenFactory: () => '0123456789abcdef0123456789abcdef',
+    });
+
+    assert.equal(
+      output,
+      [
+        '::stop-commands::0123456789abcdef0123456789abcdef',
+        'first',
+        '::error::not a real annotation',
+        '::0123456789abcdef0123456789abcdef::',
+        '',
+      ].join('\n')
+    );
+  });
+
+  it('uses a fresh 128-bit token for every print', () => {
+    const tokenPattern = /^::stop-commands::([0-9a-f]{32})$/m;
+    const first = capturePrint('a', { githubActions: true });
+    const second = capturePrint('b', { githubActions: true });
+    const firstToken = first.match(tokenPattern)?.[1];
+    const secondToken = second.match(tokenPattern)?.[1];
+
+    assert.ok(firstToken && secondToken);
+    assert.notEqual(firstToken, secondToken);
+    assert.ok(first.endsWith(`::${firstToken}::\n`));
+  });
+
+  it('follows GITHUB_ACTIONS when not told otherwise', () => {
+    const saved = process.env.GITHUB_ACTIONS;
+
+    try {
+      process.env.GITHUB_ACTIONS = 'true';
+      assert.match(capturePrint('x'), /^::stop-commands::/);
+      process.env.GITHUB_ACTIONS = '';
+      assert.equal(capturePrint('x'), 'x\n');
+    } finally {
+      if (saved === undefined) {
+        delete process.env.GITHUB_ACTIONS;
+      } else {
+        process.env.GITHUB_ACTIONS = saved;
+      }
+    }
+  });
+
+  it('guards every script that prints a changeset or release description', () => {
+    for (const file of [
+      'js/scripts/validate-changeset.mjs',
+      'js/scripts/merge-changesets.mjs',
+      'js/scripts/create-manual-changeset.mjs',
+      'js/scripts/version-and-commit.mjs',
+    ]) {
+      const source = readFileSync(repoPath(file), 'utf8');
+
+      assert.match(
+        source,
+        /from '\.\.\/\.\.\/scripts\/github-actions-log\.mjs'/,
+        file
+      );
+      assert.match(source, /printUntrusted\(/, file);
+    }
+  });
+});

package/tests/unit/scripts/links-workflow.test.js

@@ -0,0 +1,42 @@
+/**
+ * links.yml runs lychee with `--cache`, which reads and writes `.lycheecache`
+ * in the workspace. Every job starts from a fresh checkout, so without a step
+ * that restores and saves that file the flag does nothing: each run checked
+ * every link from scratch, while the job comment promised "<1min with the
+ * lychee cache" (issue #128). The lychee-action README pairs the flag with
+ * actions/cache for this reason.
+ */
+
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { describe, it } from 'node:test';
+
+import { repoPath } from '../../helpers/repo.js';
+
+const workflow = readFileSync(
+  repoPath('.github/workflows/links.yml'),
+  'utf8'
+).replaceAll('\r\n', '\n');
+
+describe('links.yml lychee cache', () => {
+  const lycheeStep = workflow.indexOf('uses: lycheeverse/lychee-action@');
+  const usesCacheFlag = /^\s+--cache\s*$/m.test(workflow);
+
+  it('runs lychee', () => {
+    assert.ok(lycheeStep > 0, 'lychee step not found');
+  });
+
+  it('restores .lycheecache before lychee when --cache is on', () => {
+    if (!usesCacheFlag) {
+      return;
+    }
+    const cacheStep = workflow.search(
+      /uses: actions\/cache@\S+\n\s+with:\n\s+path: \.lycheecache\n/
+    );
+    assert.ok(
+      cacheStep > 0,
+      '--cache needs an actions/cache step for .lycheecache'
+    );
+    assert.ok(cacheStep < lycheeStep, 'the cache must be restored first');
+  });
+});