browser-commander 0.26.0 → 0.26.2

package/tests/unit/scripts/run-with-budget-warning.test.js

@@ -3,16 +3,26 @@
  *
  * A job killed by `timeout-minutes` is reported as cancelled, which is not a
  * failure; a step that owns its budget exits non-zero instead, so the overrun
- * turns a check red and names the deadline it blew. These tests pin the three
+ * turns a check red and names the deadline it blew. These tests pin the
  * properties the workflows depend on: the command's own exit status is passed
- * through untouched, an overrun exits 124 with an error annotation, and the
- * whole process tree is killed rather than just the direct child.
+ * through untouched, an overrun exits 124 with an error annotation, the whole
+ * process tree is killed rather than just the direct child (with SIGKILL when
+ * SIGTERM is ignored), and a surviving child cannot hold the caller's output
+ * pipe open (issue #128, ported from the link-foundation pipeline templates).
  *
  * See docs/CI-TIMEOUT-BUDGETS.md.
  */
 
 import assert from 'node:assert/strict';
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { spawn, spawnSync } from 'node:child_process';
+import {
+  chmodSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { describe, it } from 'node:test';
@@ -21,10 +31,69 @@ import { BASH_AVAILABLE, repoPath, runBashScript } from '../../helpers/repo.js';
 
 const SCRIPT = repoPath('scripts/run-with-budget-warning.sh');
 
+// pgrep/pkill and POSIX process groups: the survivor checks need both.
+const POSIX = BASH_AVAILABLE && process.platform !== 'win32';
+
+/** A sleep duration nothing else uses, so pgrep can find exactly this one. */
+function markerSeconds(base) {
+  return base + (process.pid % 1000);
+}
+
+function survivorsOf(pattern) {
+  return spawnSync('pgrep', ['-f', pattern], {
+    encoding: 'utf8',
+  }).stdout.trim();
+}
+
+// Quiet unless a test asks otherwise, even when this suite itself runs in a
+// job re-run with debug logging.
+const QUIET = {
+  BUDGET_GRACE_SECONDS: '1',
+  BUDGET_VERBOSE: '',
+  RUNNER_DEBUG: '',
+};
+
 function runWrapper(args, env = {}) {
-  return runBashScript(SCRIPT, args, {
-    env: { BUDGET_GRACE_SECONDS: '1', ...env },
+  return runBashScript(SCRIPT, args, { env: { ...QUIET, ...env } });
+}
+
+/**
+ * Run the wrapper without letting a process it failed to stop hang the test.
+ * A survivor that still holds the output pipe would keep spawnSync waiting
+ * forever, so give up after a deadline and kill whatever matches `marker`.
+ */
+async function runWrapperBounded(args, env, marker, timeoutMs = 20_000) {
+  const child = spawn('bash', [SCRIPT, ...args], {
+    env: { ...process.env, ...QUIET, ...env },
+  });
+  let stdout = '';
+  let output = '';
+  child.stdout.on('data', (chunk) => {
+    stdout += chunk;
+    output += chunk;
   });
+  child.stderr.on('data', (chunk) => {
+    output += chunk;
+  });
+
+  let timer;
+  try {
+    return await Promise.race([
+      new Promise((resolve) =>
+        child.on('close', (status) => resolve({ status, stdout, output }))
+      ),
+      new Promise((resolve) => {
+        timer = setTimeout(
+          () => resolve({ status: 'timed out', stdout, output }),
+          timeoutMs
+        );
+      }),
+    ]);
+  } finally {
+    clearTimeout(timer);
+    spawnSync('pkill', ['-KILL', '-f', marker]);
+    child.kill('SIGKILL');
+  }
 }
 
 describe('run-with-budget-warning.sh', { skip: !BASH_AVAILABLE }, () => {
@@ -112,4 +181,141 @@ describe('run-with-budget-warning.sh', { skip: !BASH_AVAILABLE }, () => {
     assert.equal(runWrapper(['0', 'bad budget', 'true']).status, 2);
     assert.equal(runWrapper(['5']).status, 2);
   });
+
+  it(
+    'escalates to SIGKILL when the command ignores SIGTERM',
+    { skip: !POSIX },
+    async () => {
+      const directory = mkdtempSync(path.join(tmpdir(), 'budget-child-'));
+      const child = path.join(directory, 'ignore-term.sh');
+      // Stays in bash so the trap keeps applying; an exec would drop it. The
+      // sleep keeps the loop idle instead of spinning a core.
+      writeFileSync(
+        child,
+        [
+          '#!/usr/bin/env bash',
+          `trap 'echo "child ignored SIGTERM"' TERM`,
+          'while :; do sleep 0.2; done',
+          '',
+        ].join('\n')
+      );
+      chmodSync(child, 0o755);
+
+      try {
+        const { status, output } = await runWrapperBounded(
+          ['1', 'stubborn step', child],
+          {},
+          child
+        );
+
+        assert.equal(status, 124);
+        assert.match(
+          output,
+          /stubborn step ignored SIGTERM after 1s; sending SIGKILL\./
+        );
+        assert.equal(survivorsOf(child), '');
+      } finally {
+        rmSync(directory, { force: true, recursive: true });
+      }
+    }
+  );
+
+  it(
+    'does not let a surviving child hold the output pipe open',
+    { skip: !POSIX },
+    async () => {
+      // The child inherits the wrapper's captured files, not the caller's
+      // pipe, so a caller reading to EOF is not held up by it.
+      const marker = `^sleep ${markerSeconds(800000)}$`;
+      const { status, stdout } = await runWrapperBounded(
+        [
+          '30',
+          'detached worker',
+          'bash',
+          '-c',
+          `sleep ${markerSeconds(800000)} & echo root-finished`,
+        ],
+        { BUDGET_POLL_SECONDS: '0.05' },
+        marker
+      );
+
+      assert.equal(status, 0, 'the wrapper output pipe stayed open');
+      assert.match(stdout, /root-finished/);
+      assert.match(stdout, /detached worker finished/);
+    }
+  );
+
+  it('keeps its control state when the command cleans TMPDIR', () => {
+    const root = mkdtempSync(path.join(tmpdir(), 'budget-state-'));
+    const commandTmp = path.join(root, 'command-tmp');
+    const runnerTmp = path.join(root, 'runner-tmp');
+    mkdirSync(commandTmp);
+    mkdirSync(runnerTmp);
+
+    try {
+      const { status, output } = runWrapper(
+        [
+          '10',
+          'tmp-cleaning step',
+          'bash',
+          '-c',
+          'rm -rf "${TMPDIR:?}"/*; echo command-completed',
+        ],
+        { TMPDIR: commandTmp, RUNNER_TEMP: runnerTmp }
+      );
+
+      assert.equal(status, 0);
+      assert.match(output, /command-completed/);
+      assert.doesNotMatch(output, /No such file or directory/);
+    } finally {
+      rmSync(root, { force: true, recursive: true });
+    }
+  });
+
+  it('enforces the budget on a fractional poll interval', () => {
+    const { status, output } = runWrapper(
+      ['1', 'fractional poll', 'sleep', '30'],
+      { BUDGET_POLL_SECONDS: '0.5' }
+    );
+
+    assert.equal(status, 124);
+    assert.doesNotMatch(output, /invalid arithmetic operator/);
+  });
+
+  it('rejects a poll interval that is not a number', () => {
+    const { status, output } = runWrapper(['5', 'bad poll', 'true'], {
+      BUDGET_POLL_SECONDS: 'soon',
+    });
+
+    assert.equal(status, 2);
+    assert.match(output, /BUDGET_POLL_SECONDS must be a positive number/);
+  });
+
+  it(
+    'lists what is still running at an overrun only when asked to',
+    { skip: !POSIX },
+    () => {
+      // Issue #128: a Windows `cargo test --doc` step printed nothing for its
+      // whole budget, leaving no trace of what it was stuck on. The snapshot
+      // is opt-in (BUDGET_VERBOSE, or GitHub's "debug logging" re-run, which
+      // sets RUNNER_DEBUG) so ordinary logs stay as they were.
+      const seconds = markerSeconds(700000);
+      const args = ['1', 'stalled step', 'sleep', String(seconds)];
+
+      const quiet = runWrapper(args);
+      assert.equal(quiet.status, 124);
+      assert.doesNotMatch(quiet.output, /\[budget\]/);
+
+      for (const env of [{ BUDGET_VERBOSE: '1' }, { RUNNER_DEBUG: '1' }]) {
+        const { status, output } = runWrapper(args, env);
+        assert.equal(status, 124);
+        assert.match(
+          output,
+          new RegExp(
+            `\\[budget\\] still running at the overrun:\\n.*sleep ${seconds}`
+          )
+        );
+      }
+    }
+  );
 });

package/tests/unit/scripts/trusted-publishing.test.js

@@ -0,0 +1,78 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { parse } from 'yaml';
+
+import { readRepoText } from '../../helpers/repo.js';
+
+describe('trusted publishing configuration', () => {
+  const rust = parse(readRepoText('.github/workflows/rust.yml'));
+
+  for (const jobId of ['auto-release', 'manual-release']) {
+    it(`${jobId} uses a fresh OIDC token only when publishing`, () => {
+      const job = rust.jobs[jobId];
+      assert.equal(job.permissions['id-token'], 'write');
+      const auth = job.steps.find((step) => step.id === 'crates_auth');
+      const publish = job.steps.find((step) => step.id === 'publish-crate');
+      assert.ok(auth, 'missing crates.io authentication step');
+      assert.match(
+        auth.uses,
+        /^rust-lang\/crates-io-auth-action@[a-f0-9]{40}$/
+      );
+      assert.equal(auth.if, publish.if);
+      assert.equal(
+        publish.env.CARGO_REGISTRY_TOKEN,
+        '${{ steps.crates_auth.outputs.token }}'
+      );
+      assert.ok(job.steps.indexOf(auth) < job.steps.indexOf(publish));
+      assert.ok(
+        job.steps.indexOf(auth) >
+          job.steps.findIndex((step) => step.name === 'Build release')
+      );
+    });
+  }
+
+  it('never reads the long-lived Cargo secret in the Rust workflow', () => {
+    assert.doesNotMatch(
+      readRepoText('.github/workflows/rust.yml'),
+      /secrets\.CARGO_TOKEN/
+    );
+  });
+
+  it('keeps the registered PyPI identity identical across preflight and releases', () => {
+    const python = parse(readRepoText('.github/workflows/python.yml'));
+    for (const jobId of [
+      'release-preflight',
+      'auto-release',
+      'manual-release',
+    ]) {
+      assert.equal(python.jobs[jobId].permissions['id-token'], 'write');
+      assert.equal(python.jobs[jobId].environment, undefined);
+    }
+  });
+
+  it('marks the template snapshot as private without hiding the real npm package', () => {
+    assert.equal(
+      JSON.parse(
+        readRepoText(
+          'docs/case-studies/issue-55/template-snapshots/js/package.json'
+        )
+      ).private,
+      true
+    );
+    assert.notEqual(JSON.parse(readRepoText('js/package.json')).private, true);
+  });
+
+  it('disables publishing for the cookie equivalence experiment only', () => {
+    const fixture = readRepoText(
+      'experiments/issue-128/cookie-fixture-equivalence/Cargo.toml'
+    );
+    const packageTable = fixture
+      .split(/^\[package\]\s*$/m)[1]
+      ?.split(/^\[/m)[0];
+    assert.match(packageTable ?? '', /^publish\s*=\s*false\s*$/m);
+    assert.doesNotMatch(
+      readRepoText('rust/Cargo.toml'),
+      /^publish\s*=\s*false\s*$/m
+    );
+  });
+});

package/tests/unit/scripts/use-module-integration.test.js

@@ -16,18 +16,11 @@ import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
 
 import {
+  isUseMReachable,
   loadCommandStream,
   USE_M_URL,
 } from '../../../../scripts/use-module.mjs';
 
-async function hasNetwork() {
-  try {
-    return (await fetch(USE_M_URL, { method: 'HEAD' })).ok;
-  } catch {
-    return false;
-  }
-}
-
 describe('use-m loads command-stream on this Node version', () => {
   it('exposes a callable $ from command-stream', async (t) => {
     if (process.platform === 'win32') {
@@ -38,7 +31,7 @@ describe('use-m loads command-stream on this Node version', () => {
       return t.skip('use-m cannot import absolute paths on Windows');
     }
 
-    if (!(await hasNetwork())) {
+    if (!(await isUseMReachable())) {
       return t.skip(
         `${USE_M_URL} is unreachable, so use-m cannot be evaluated`
       );

package/tests/unit/scripts/use-module.test.js

@@ -3,6 +3,7 @@ import { describe, it } from 'node:test';
 
 import {
   describeModule,
+  isUseMReachable,
   loadCommandStream,
   loadLinoArguments,
   loadUse,
@@ -147,6 +148,25 @@ describe('use-module interop shim', () => {
     assert.equal(typeof module.makeConfig, 'function');
   });
 
+  it('reports use-m as unreachable on an error status or a failed fetch', async () => {
+    const requests = [];
+    assert.equal(
+      await isUseMReachable(async (url, init) => {
+        requests.push([url, init.method]);
+        return { ok: true };
+      }),
+      true
+    );
+    assert.deepEqual(requests, [[USE_M_URL, 'HEAD']]);
+    assert.equal(await isUseMReachable(async () => ({ ok: false })), false);
+    assert.equal(
+      await isUseMReachable(async () => {
+        throw new TypeError('fetch failed');
+      }),
+      false
+    );
+  });
+
   it('points at the unpinned use-m entry point', () => {
     assert.equal(USE_M_URL, 'https://unpkg.com/use-m/use.js');
   });

package/tests/unit/scripts/validate-changeset.test.js

@@ -0,0 +1,127 @@
+/**
+ * The changeset check must fail when it cannot see what a pull request adds.
+ *
+ * Issue #128: when `git diff` against the base failed, the script fell back to
+ * every changeset in `.changeset/`, so a stale changeset already on the base
+ * branch satisfied "this PR adds exactly one changeset" — a false pass. The
+ * fallback stays for local runs, where there is no pull request to compare.
+ */
+
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+
+import { repoPath } from '../../helpers/repo.js';
+
+const SCRIPT = repoPath('js/scripts/validate-changeset.mjs');
+
+const CHANGESET = `---
+'browser-commander': patch
+---
+
+::error::not a real annotation
+`;
+
+function git(directory, ...args) {
+  return spawnSync(
+    'git',
+    [
+      '-C',
+      directory,
+      '-c',
+      'user.name=t',
+      '-c',
+      'user.email=t@example.com',
+      ...args,
+    ],
+    { encoding: 'utf8' }
+  );
+}
+
+/** A repository with no origin whose only changeset is already committed. */
+function withStaleChangeset(run) {
+  const directory = mkdtempSync(path.join(tmpdir(), 'validate-changeset-'));
+  const jsDirectory = path.join(directory, 'js');
+
+  try {
+    mkdirSync(path.join(jsDirectory, '.changeset'), { recursive: true });
+    writeFileSync(path.join(jsDirectory, '.changeset', 'stale.md'), CHANGESET);
+    git(directory, 'init', '-q');
+    git(directory, 'add', '.');
+    git(directory, 'commit', '-q', '-m', 'init');
+    return run(jsDirectory);
+  } finally {
+    rmSync(directory, { force: true, recursive: true });
+  }
+}
+
+function validate(cwd, env) {
+  const base = { ...process.env };
+  for (const name of [
+    'GITHUB_BASE_REF',
+    'GITHUB_BASE_SHA',
+    'GITHUB_HEAD_SHA',
+    'BASE_SHA',
+    'HEAD_SHA',
+  ]) {
+    delete base[name];
+  }
+
+  return spawnSync(process.execPath, [SCRIPT], {
+    cwd,
+    encoding: 'utf8',
+    env: { ...base, GITHUB_ACTIONS: '', ...env },
+    timeout: 30_000,
+  });
+}
+
+describe('validate-changeset', () => {
+  it('fails a pull request whose diff cannot be computed', () => {
+    withStaleChangeset((cwd) => {
+      const result = validate(cwd, { GITHUB_BASE_REF: 'main' });
+
+      assert.equal(result.status, 1, result.stdout + result.stderr);
+      assert.match(result.stderr, /::error::Could not determine/);
+      assert.doesNotMatch(result.stdout, /Changeset validation passed/);
+    });
+  });
+
+  it('fails when explicit pull request SHAs cannot be compared', () => {
+    withStaleChangeset((cwd) => {
+      const result = validate(cwd, {
+        GITHUB_BASE_SHA: '0'.repeat(40),
+        GITHUB_HEAD_SHA: 'HEAD',
+      });
+
+      assert.equal(result.status, 1, result.stdout + result.stderr);
+      assert.doesNotMatch(result.stdout, /Changeset validation passed/);
+    });
+  });
+
+  it('still checks the changesets on disk outside a pull request', () => {
+    withStaleChangeset((cwd) => {
+      const result = validate(cwd, {});
+
+      assert.equal(result.status, 0, result.stdout + result.stderr);
+      assert.match(result.stdout, /Changeset validation passed/);
+    });
+  });
+
+  it('does not let the changeset description raise an annotation', () => {
+    withStaleChangeset((cwd) => {
+      const result = validate(cwd, { GITHUB_ACTIONS: 'true' });
+
+      assert.equal(result.status, 0, result.stdout + result.stderr);
+      const token = result.stdout.match(/^::stop-commands::([0-9a-f]{32})$/m);
+      assert.ok(token, result.stdout);
+      const guarded = result.stdout.split(`::stop-commands::${token[1]}\n`)[1];
+      assert.match(
+        guarded,
+        new RegExp(`^::error::not a real annotation\\n::${token[1]}::$`, 'm')
+      );
+    });
+  });
+});

package/tests/unit/scripts/zizmor-version.test.js

@@ -0,0 +1,82 @@
+/**
+ * Every zizmor in ci-policy.yml must be the same zizmor (issue #128).
+ *
+ * The zizmor job runs the analyser twice: once through zizmor-action, once
+ * through `pipx run zizmor==X` for the pedantic-only image audit. A comment
+ * documents the `pipx` command that reproduces the job. When those three name
+ * different versions, a finding seen in CI cannot be reproduced with the
+ * documented command, and the two passes disagree on what the audits are —
+ * the JS pipeline template ships exactly that split (action 1.29.0, pedantic
+ * pass 1.30.0).
+ *
+ * The action also refuses a version absent from its own digest table
+ * ("Unknown version"), so the action tag is recorded next to the newest
+ * version it knows: bumping `version:` without bumping the action fails here
+ * instead of on the pull request.
+ */
+
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { describe, it } from 'node:test';
+
+import { repoPath } from '../../helpers/repo.js';
+
+// support/versions of each zizmor-action release, newest entry only.
+const ACTION_NEWEST_ZIZMOR = {
+  'v0.6.2': '1.29.0',
+  'v0.6.3': '1.30.0',
+  'v0.6.4': '1.30.1',
+};
+
+function compareVersions(a, b) {
+  const pa = a.split('.').map(Number);
+  const pb = b.split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    if (pa[i] !== pb[i]) {
+      return pa[i] - pb[i];
+    }
+  }
+  return 0;
+}
+
+const workflow = readFileSync(
+  repoPath('.github/workflows/ci-policy.yml'),
+  'utf8'
+).replaceAll('\r\n', '\n');
+
+describe('zizmor version in ci-policy.yml', () => {
+  const actionTag = workflow.match(/zizmorcore\/zizmor-action@(v[\d.]+)/)?.[1];
+  const actionVersion = workflow.match(
+    /zizmor-action@[^\n]+\n(?: {8}.*\n)*? {10}version: ([\d.]+)/
+  )?.[1];
+  const pipxVersions = [...workflow.matchAll(/zizmor==([\d.]+)/g)].map(
+    (m) => m[1]
+  );
+
+  it('names an explicit zizmor version for the action', () => {
+    assert.ok(actionTag, 'zizmor-action step not found');
+    assert.ok(actionVersion, 'zizmor-action step has no `version:` input');
+  });
+
+  it('uses one zizmor version in the action, the pipx pass and the reproduce comment', () => {
+    assert.ok(
+      pipxVersions.length >= 2,
+      'expected the pedantic pass and the reproduce comment'
+    );
+    for (const version of pipxVersions) {
+      assert.equal(version, actionVersion);
+    }
+  });
+
+  it('asks the action only for a version its digest table contains', () => {
+    const newest = ACTION_NEWEST_ZIZMOR[actionTag];
+    assert.ok(
+      newest,
+      `record the newest zizmor in ${actionTag}'s support/versions here`
+    );
+    assert.ok(
+      compareVersions(actionVersion, newest) <= 0,
+      `zizmor-action ${actionTag} cannot install zizmor ${actionVersion}`
+    );
+  });
+});

package/tests/unit/tests/index.test.js

@@ -249,6 +249,49 @@ describe('browser-commander/tests', () => {
     }
   });
 
+  it('names failure artifacts without leading or trailing dashes', async () => {
+    const tmpDir = mkdtempSync(path.join(os.tmpdir(), 'bc-artifacts-'));
+
+    try {
+      const [errorPath] = await writeFailureArtifacts({
+        error: new Error('broken'),
+        testId: '--checkout / pay--',
+        engine: 'playwright--',
+        artifactsDir: tmpDir,
+      });
+
+      assert.strictEqual(
+        path.basename(errorPath),
+        'checkout-pay---playwright.error.json'
+      );
+    } finally {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it('sanitizes a long run of dashes in linear time', async () => {
+    // /^-+|-+$/g backtracked quadratically on inner dashes: about 4s for this
+    // name (CodeQL js/polynomial-redos, issue #128). A name this long cannot
+    // be a file name, so the write fails; it must fail promptly.
+    const tmpDir = mkdtempSync(path.join(os.tmpdir(), 'bc-artifacts-'));
+
+    try {
+      const started = performance.now();
+      await assert.rejects(() =>
+        writeFailureArtifacts({
+          error: new Error('broken'),
+          testId: `a${'-'.repeat(50_000)}a`,
+          engine: 'playwright',
+          artifactsDir: tmpDir,
+        })
+      );
+      const elapsed = performance.now() - started;
+      assert.ok(elapsed < 1000, `took ${elapsed.toFixed(0)}ms`);
+    } finally {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
   it('captures failure artifacts before closing failed browser scenarios', async () => {
     const tmpDir = mkdtempSync(path.join(os.tmpdir(), 'bc-scenario-'));
     const calls = [];