canary-test-cli 6.6.0 → 6.7.1

package/dist/engine/core/static-linter.js

@@ -301,16 +301,56 @@ function scanAssertionFreeJs(code, file) {
     }
     return out;
 }
-function detectFramework(path) {
+/**
+ * Extensions whose contents the JS/TS scanners can actually read. ESM (`.mjs`)
+ * and CJS (`.cjs`) belong here as much as `.js` does -- omitting them is what
+ * made #566 possible.
+ */
+export const JS_TEST_EXTENSIONS = [
+    '.ts',
+    '.js',
+    '.mjs',
+    '.cjs',
+    '.mts',
+    '.cts',
+];
+const JS_EXT_SET = new Set(JS_TEST_EXTENSIONS);
+/**
+ * The framework whose scanners can parse `path`, or `null` when no scanner
+ * understands the extension.
+ *
+ * This deliberately has no default. The previous `return 'pytest'` fallback
+ * meant an unrecognised extension was silently handed to the Python assertion
+ * scanners: over ESM JavaScript they match nothing, so a `.mjs` file with real
+ * defects linted to zero findings and rendered a green all-clear (#566). A
+ * guess that cannot be distinguished from a clean result is a false green;
+ * `null` forces the caller to abstain instead.
+ */
+export function lintableFramework(path) {
     const suffix = extname(path).toLowerCase();
     const name = basename(path).toLowerCase();
     if (suffix === '.py')
         return 'pytest';
     if (name.includes('playwright'))
         return 'playwright';
-    if (suffix === '.ts' || suffix === '.js')
+    if (JS_EXT_SET.has(suffix))
         return 'vitest';
-    return 'pytest';
+    return null;
+}
+/** Thrown when a scanner is asked for a file no ruleset can parse. */
+export class UnsupportedTestFileError extends Error {
+    path;
+    constructor(path) {
+        super(`No linter ruleset can parse ${extname(path) || basename(path)}`);
+        this.path = path;
+        this.name = 'UnsupportedTestFileError';
+    }
+}
+function requireFramework(path, framework) {
+    const fw = framework || lintableFramework(path);
+    if (fw === null)
+        throw new UnsupportedTestFileError(path);
+    return fw;
 }
 export class StaticLinter {
     /** Full quality audit — all rules. */
@@ -322,7 +362,7 @@ export class StaticLinter {
         // scanners go on mining `it(...)` declarations out of diff fixtures.
         const lines = blankMultilineStrings(code.split('\n'));
         const scanned = lines.join('\n');
-        const fw = framework || detectFramework(path);
+        const fw = requireFramework(path, framework);
         const findings = [
             ...scanFlakiness(lines, path),
             ...scanSelectors(lines, path),

package/dist/engine/guardian/adjudication.js

@@ -33,14 +33,21 @@ import { mkdirSync, readFileSync, readdirSync, renameSync, statSync, unlinkSync,
 import { randomBytes } from 'node:crypto';
 import { dirname, join } from 'node:path';
 import { STICKY_MARKER, findSticky } from './pr-comment.js';
+import { readAllPages, restPageReader } from './github-paging.js';
 /** Schema tag for adjudication records (independent of the findings schema). */
 export const ADJUDICATION_SCHEMA_VERSION = '1.0';
 /**
  * Record `source` + filename prefix. Deliberately namespaced UNDER the
- * `canary-pr-guardian-` prefix (harness's `AnalysisArchive` reads every
- * `*.json` in `.harness/analyses/`) while never colliding with a pr-check
- * findings record: those are `canary-pr-guardian-<sanitized-ref>.json` and a
- * ref is sanitized from a git ref / `pr-<n>`, never `adjudication-pr-<n>`.
+ * `canary-pr-guardian-` prefix, because harness's `AnalysisArchive` reads every
+ * `*.json` in `.harness/analyses/`.
+ *
+ * The filenames are not provably distinct, though: a branch named
+ * `adjudication/pr-42` sanitizes through `analysisFilename` to exactly
+ * `canary-pr-guardian-adjudication-pr-42.json`, colliding with this prefix.
+ * What actually keeps the precision summary honest is the `source` field —
+ * `loadAdjudicationRecords` requires `source === ADJUDICATION_SOURCE` plus
+ * numeric `tp`/`fp`, so a findings record landing on that name is skipped, not
+ * mis-tallied. Read the field, never the filename.
  */
 export const ADJUDICATION_SOURCE = 'canary-pr-guardian-adjudication';
 /** GitHub reaction contents that carry an adjudication verdict. */
@@ -68,44 +75,35 @@ export class FakeReactionsClient {
 }
 /**
  * Thin real {@link ReactionsClient} over the GitHub REST API (`fetch`).
- * Network lives ONLY here; no unit test exercises this class. Both endpoints
- * are reads, so a fork's read-only token is sufficient.
+ * Network lives ONLY in the default {@link restPageReader}; both endpoints are
+ * reads, so a fork's read-only token is sufficient. The `read` seam exists so
+ * the #528 paging wiring is testable without a socket — production callers
+ * construct this with three arguments and get the real reader.
  */
 export class RestReactionsClient {
     repo;
     prNumber;
-    token;
     static API = 'https://api.github.com';
-    constructor(repo, prNumber, token) {
+    read;
+    constructor(repo, prNumber, token, read) {
         this.repo = repo;
         this.prNumber = prNumber;
-        this.token = token;
-    }
-    async get(url) {
-        const resp = await fetch(url, {
-            method: 'GET',
-            headers: {
-                Authorization: `Bearer ${this.token}`,
-                Accept: 'application/vnd.github+json',
-                'X-GitHub-Api-Version': '2022-11-28',
-                'User-Agent': 'canary-pr-guardian',
-            },
-        });
-        if (!resp.ok) {
-            throw new Error(`GitHub API ${resp.status}: ${url}`);
-        }
-        return resp.json();
+        this.read =
+            read ??
+                restPageReader({
+                    Authorization: `Bearer ${token}`,
+                    Accept: 'application/vnd.github+json',
+                    'X-GitHub-Api-Version': '2022-11-28',
+                    'User-Agent': 'canary-pr-guardian',
+                }, (status, url) => new Error(`GitHub API ${status}: ${url}`));
     }
     async listComments() {
         const url = `${RestReactionsClient.API}/repos/${this.repo}/issues/${this.prNumber}/comments`;
-        const result = await this.get(url);
-        return Array.isArray(result) ? result : [];
+        return (await readAllPages(url, this.read));
     }
     async listReactions(commentId) {
         const url = `${RestReactionsClient.API}/repos/${this.repo}/issues/comments/${commentId}/reactions`;
-        const result = await this.get(url);
-        if (!Array.isArray(result))
-            return [];
+        const result = await readAllPages(url, this.read);
         const rows = [];
         for (const raw of result) {
             if (typeof raw !== 'object' || raw === null)
@@ -155,7 +153,13 @@ export function tallyAdjudications(reactions) {
 // neither of which starts with a backtick, so anchoring on the second cell's
 // leading backtick selects exactly the finding rows. Paths never contain `|`
 // or backticks (see `fileLabel` in pr-check.ts), so the naive anchor is safe.
-const FINDING_ROW_RE = /^\|[^|]*\|\s*`([^`]+)`/;
+//
+// The optional `[` accommodates the permalinked cell — `fileLabel` wraps the
+// path as `[`path`](<blob url>)` whenever a blob base is resolvable, which is
+// the normal case in CI. Without it this regex matched nothing on every posted
+// comment and `activeFindingPaths` returned `[]`, zeroing the precision
+// denominator silently instead of failing (#490, #508).
+const FINDING_ROW_RE = /^\|[^|]*\|\s*\[?`([^`]+)`/;
 /**
  * Extract the file paths of the ACTIVE findings shown in a sticky-comment body
  * (PURE). Reads the rendered table `render(fmt='comment')` emitted — this is

package/dist/engine/guardian/analysis-emit.js

@@ -34,8 +34,10 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { mkdirSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { render } from './pr-check.js';
-export const SCHEMA_VERSION = '1.0';
+import { coverageDegradedNotice, coverageStatus, } from './coverage.js';
+import { combineNotices, render } from './pr-check.js';
+// 1.1 adds the additive `coverage` block (#554); readers of 1.0 are unaffected.
+export const SCHEMA_VERSION = '1.1';
 export const SOURCE = 'canary-pr-guardian';
 const REF_SAFE = /[^A-Za-z0-9._-]/g;
 const REF_MAX = 100; // cap the sanitized ref so a long branch never hits ENAMETOOLONG
@@ -94,7 +96,11 @@ function isoUtcNow() {
  */
 export function buildAnalysisRecord(findings, args) {
     const { ref, gate, effective_tier, degraded_notice, exit_code } = args;
-    const inner = JSON.parse(render(findings, 'json', effective_tier, degraded_notice));
+    // #554: the record states BOTH degradations — the tier's and the coverage
+    // input's — so "no findings" can never be read as "coverage said so".
+    const coverage = args.coverage ?? null;
+    const notice = combineNotices(degraded_notice, coverage ? coverageDegradedNotice(coverage) : null);
+    const inner = JSON.parse(render(findings, 'json', effective_tier, notice));
     const active = findings.filter((f) => !f.suppressed);
     const suppressed = findings.filter((f) => f.suppressed);
     const byFidelity = {};
@@ -110,7 +116,10 @@ export function buildAnalysisRecord(findings, args) {
         checked: args.checked ?? 0,
         abstained: args.abstained ?? false,
         tier: effective_tier,
-        degradedNotice: degraded_notice,
+        degradedNotice: notice,
+        coverage: coverage === null
+            ? null
+            : { status: coverageStatus(coverage), ...coverage },
         summary: {
             total: findings.length,
             unaddressed: active.length,

package/dist/engine/guardian/cli.js

@@ -53,12 +53,12 @@ import { AuthoringContext, InSessionAgentProbe, InSessionAgentTier, decideBlock,
 import { RestReactionsClient, collectAdjudications, loadAdjudicationRecords, renderPrecision, summarizePrecision, } from './adjudication.js';
 import { emitAnalysis } from './analysis-emit.js';
 import { gateOutcome } from '../core/gate-result.js';
-import { resolveCoverage, validateCoverageJson, } from './coverage.js';
+import { coverageDegradedNotice, resolveCoverage, resolveCoverageWithInput, validateCoverageJson, } from './coverage.js';
 import { buildApiDelta, writeApiDelta } from './delta-emitter.js';
 import { extractApiDiff } from './diff-extractor.js';
 import { HardGateAbstained, HardGateBlocked, RestBranchProtectionClient, applyHardGate, renderPlaybook, } from './hard-gate.js';
 import { mapImpact } from './impact-mapper.js';
-import { applySuppressions, buildFindings, buildWeakTestFindings, computeExitCode, effectiveGraphDepth, filterHeuristicNoise, filterSkipped, filterTestUnits, findReexportOnly, loadGuardianConfig, render, scopeDiff, } from './pr-check.js';
+import { applySuppressions, buildFindings, buildWeakTestFindings, computeExitCode, effectiveGraphDepth, filterHeuristicNoise, filterSkipped, filterTestSupportUnits, filterTestUnits, filterTypeOnlyUnits, findReexportOnly, loadGuardianConfig, render, scopeDiff, } from './pr-check.js';
 import { RestGitHubClient, degradationAnnotation, upsertStickyComment, } from './pr-comment.js';
 import { buildSummary } from './summary-emitter.js';
 import { resolveTier } from './tier.js';
@@ -202,6 +202,53 @@ export function prContextFromEnv(env) {
     }
     return null;
 }
+/**
+ * The `https://github.com/<owner>/<repo>/blob/<sha>` prefix for comment
+ * permalinks, or `null` when it cannot be resolved.
+ *
+ * Prefers `pull_request.head.sha` from the event payload over `GITHUB_SHA`: on
+ * a `pull_request` event `GITHUB_SHA` is the ephemeral merge commit, and a blob
+ * URL against it can 404 once the ref is gone. The head SHA is a real commit on
+ * the contributor's branch and stays resolvable.
+ *
+ * Returns `null` rather than a partial URL whenever repo or SHA is missing, so
+ * {@link render} falls back to plain code text. That degradation is deliberate:
+ * an unresolvable link still *looks* clickable, which is worse than no link.
+ */
+export function blobBaseFromEnv(env) {
+    const repo = env['GITHUB_REPOSITORY'];
+    if (!repo || !repo.includes('/'))
+        return null;
+    const sha = headShaFromEvent(env['GITHUB_EVENT_PATH']) ?? env['GITHUB_SHA'];
+    if (!sha)
+        return null;
+    return `https://github.com/${repo}/blob/${sha}`;
+}
+/**
+ * `pull_request.head.sha` from the event payload at `eventPath`, or `null`.
+ *
+ * Every failure — no path, unreadable file, non-JSON body, a payload without a
+ * `pull_request` — returns `null` so {@link blobBaseFromEnv} falls through to
+ * `GITHUB_SHA` rather than dropping links entirely: a merge-commit link still
+ * beats no link.
+ */
+function headShaFromEvent(eventPath) {
+    if (!eventPath)
+        return null;
+    try {
+        // Optional chaining carries the shape check: on a payload that is not an
+        // object (a bare number or string), `?.` short-circuits to `undefined`
+        // exactly as an explicit `typeof === 'object'` guard would.
+        const event = JSON.parse(readFileSync(eventPath, 'utf-8'));
+        const head = event?.pull_request?.head?.sha;
+        if (typeof head !== 'string')
+            return null;
+        return head || null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * At-desk fork signal (guard b), FAIL-CLOSED on ambiguity.
  *
@@ -787,8 +834,8 @@ function precisionCmd(opts, deps) {
  * PR context is resolvable from env, prints the body instead of crashing; a
  * read-only-token degradation is surfaced LOUDLY.
  */
-async function postStickyComment(findings, resolution, deps) {
-    const body = render(findings, 'comment', resolution.effective, resolution.degraded_notice);
+async function postStickyComment(findings, resolution, deps, gateMeta = null) {
+    const body = render(findings, 'comment', resolution.effective, resolution.degraded_notice, gateMeta, blobBaseFromEnv(deps.env));
     const ctx = prContextFromEnv(deps.env);
     if (ctx === null) {
         deps.out(`guardian: no PR context in env ${EM_DASH} printing instead.`);
@@ -806,10 +853,17 @@ async function postStickyComment(findings, resolution, deps) {
 // D7: every filtered path stays visible as a SkipEntry, never folded
 // into "passed". One entry per path so the rendered count still equals
 // the path count the old `N path(s) skipped` line reported.
-function prCheckSkipEntries(skipped, testUnits, barrelUnits, noisePaths = []) {
+function prCheckSkipEntries(skipped, testUnits, barrelUnits, supportUnits = [], noisePaths = [], typeOnlyUnits = []) {
     return [
         ...skipped.map((u) => ({ name: u.path, reason: 'skipGlobs' })),
         ...testUnits.map((u) => ({ name: u.path, reason: 'test path' })),
+        // #565: distinct from 'test path' on purpose -- these are test
+        // infrastructure recognised by filename idiom, and adjudication needs to
+        // tell the two suppression causes apart.
+        ...supportUnits.map((u) => ({ name: u.path, reason: 'test support' })),
+        // #562: likewise distinct -- adjudication has to be able to measure this
+        // class separately, since it is the one that held precision at 13/20.
+        ...typeOnlyUnits.map((u) => ({ name: u.path, reason: 'type-only module' })),
         ...barrelUnits.map((u) => ({
             name: u.path,
             reason: 're-export barrel',
@@ -839,7 +893,12 @@ function abstainPrCheck(skipped, format, deps) {
     for (const line of PR_CHECK_ABSTAIN_REMEDIATION)
         deps.out(line);
     if (format === 'json') {
-        deps.out(ensureAscii(JSON.stringify({ findings: [], tier: 0, checked: 0, abstained: true }, null, 2)));
+        deps.out(ensureAscii(JSON.stringify(
+        // #579: `skipped` carries the denominator the abstention collapsed
+        // to. Without it a consumer sees `abstained: true` and cannot tell
+        // WHAT was dropped or why -- the #508 class one layer down, on the
+        // only surface a machine can read.
+        { findings: [], tier: 0, checked: 0, abstained: true, skipped }, null, 2)));
     }
     throw new CliExit(outcome.exitCode); // EXIT_ABSTAINED
 }
@@ -923,19 +982,31 @@ async function prCheckCmd(opts, deps) {
     const [keptSkip, skipped] = filterSkipped(units, config.skip_globs);
     // FIX A: drop test-path units -- a test does not itself need a test.
     const [keptTest, testUnits] = filterTestUnits(keptSkip);
+    // #565: drop test *support* units -- a conftest / fixture module is the
+    // harness the tests run inside, so no test can cover it at any tier.
+    const [keptSupport, supportUnits] = filterTestSupportUnits(keptTest);
+    // #562: drop modules with no runtime content -- an interface cannot be
+    // executed, so its uncovered lines are a finding no test could ever satisfy.
+    // `.` (cwd), matching the repoRoot convention `resolveCoverageWithInput`
+    // already uses for the heuristic tier's own file reads.
+    const [keptTyped, typeOnlyUnits] = filterTypeOnlyUnits(keptSupport, '.');
     // FIX 2: drop pure re-export/barrel files.
     const reexportPaths = findReexportOnly(diffText);
-    const barrelUnits = keptTest.filter((u) => reexportPaths.has(u.path));
-    const kept = keptTest.filter((u) => !reexportPaths.has(u.path));
+    const barrelUnits = keptTyped.filter((u) => reexportPaths.has(u.path));
+    const kept = keptTyped.filter((u) => !reexportPaths.has(u.path));
     // Advisory weak-test findings for added tests that assert nothing.
     const weakFindings = config.weak_tests
         ? buildWeakTestFindings(testUnits, diffText)
         : [];
-    const preFilterSkipped = skipped.length + testUnits.length + barrelUnits.length;
+    const preFilterSkipped = skipped.length +
+        testUnits.length +
+        barrelUnits.length +
+        supportUnits.length +
+        typeOnlyUnits.length;
     if (kept.length === 0 && weakFindings.length === 0) {
-        abstainPrCheck(prCheckSkipEntries(skipped, testUnits, barrelUnits), opts.format, deps);
+        abstainPrCheck(prCheckSkipEntries(skipped, testUnits, barrelUnits, supportUnits, [], typeOnlyUnits), opts.format, deps);
     }
-    const results = resolveCoverage(kept, {
+    const { results, coverage } = resolveCoverageWithInput(kept, {
         coveragePath: opts.coverage ?? null,
         // #320: under a hard gate the graph tier requires a DIRECT test->source edge
         // (depth 1); soft stays unbounded. An explicit config value wins.
@@ -953,7 +1024,7 @@ async function prCheckCmd(opts, deps) {
     // SKIP rather than rendering an empty "0 unaddressed" report -- an adopter
     // must be able to tell "nothing was judgeable" from "everything passed".
     if (scoredResults.length === 0 && findings.length === 0) {
-        abstainPrCheck(prCheckSkipEntries(skipped, testUnits, barrelUnits, noiseResults.map((r) => r.unit.path)), opts.format, deps);
+        abstainPrCheck(prCheckSkipEntries(skipped, testUnits, barrelUnits, supportUnits, noiseResults.map((r) => r.unit.path), typeOnlyUnits), opts.format, deps);
     }
     // SC-5 (PR half): resolve the requested tier against actual capability. No
     // agent runtime exists (default NoAgentProbe), so any `pr.tier > 0` drops to
@@ -966,6 +1037,22 @@ async function prCheckCmd(opts, deps) {
     // Compute the gate result once, up front: the emitted record carries it and it
     // is the process exit at the end (SC-4 -- emit never changes the exit logic).
     const exitCode = computeExitCode(findings, effectiveGate);
+    // #554: every surface below carries the coverage-input state, so a run that
+    // never saw a coverage report cannot present as one that checked and passed.
+    const gateMeta = {
+        checked: scoredResults.length,
+        abstained: false,
+        coverage,
+    };
+    const coverageNotice = coverageDegradedNotice(coverage);
+    if (coverageNotice) {
+        // `--format json` owns stdout: a `::warning::` line there would make the
+        // document unparseable, so the annotation goes to stderr on that path. Both
+        // streams are scanned for workflow commands, so CI still sees it.
+        const machineStdout = !opts.postComment && !opts.emitAnalysis && opts.format === 'json';
+        (machineStdout ? deps.err : deps.out)(degradationAnnotation(coverageNotice));
+        appendStepSummary(deps.env, coverageNotice);
+    }
     let commentPosted = false;
     if (opts.emitAnalysis) {
         // SC-10 producer half: write ONE record to the analyses channel. On an
@@ -981,6 +1068,7 @@ async function prCheckCmd(opts, deps) {
             exit_code: exitCode,
             checked: scoredResults.length,
             abstained: false, // an abstained run exits before emit (see plan)
+            coverage,
         });
         if (res.action === 'emitted') {
             deps.out(`guardian: wrote analysis record ${RIGHT_ARROW} ${res.path}`);
@@ -991,18 +1079,18 @@ async function prCheckCmd(opts, deps) {
             deps.out(degradationAnnotation(res.notice));
             appendStepSummary(deps.env, res.notice);
             deps.err(res.notice);
-            await postStickyComment(findings, resolution, deps);
+            await postStickyComment(findings, resolution, deps, gateMeta);
             commentPosted = true;
         }
     }
     if (opts.postComment && !commentPosted) {
         // Explicit `--post-comment`: post/upsert unless the SC-10 fallback already
         // posted this run.
-        await postStickyComment(findings, resolution, deps);
+        await postStickyComment(findings, resolution, deps, gateMeta);
     }
     else if (!opts.emitAnalysis && !opts.postComment) {
         // Local, non-posting default: render to stdout in `--format`.
-        deps.out(render(findings, opts.format, resolution.effective, resolution.degraded_notice, { checked: scoredResults.length, abstained: false }));
+        deps.out(render(findings, opts.format, resolution.effective, resolution.degraded_notice, gateMeta, blobBaseFromEnv(deps.env)));
     }
     throw new CliExit(exitCode);
 }
@@ -1016,8 +1104,17 @@ function buildGaps(diffText, config, coveragePath, graphMaxDepth) {
     const units = scopeDiff(diffText);
     const [keptSkip] = filterSkipped(units, config.skip_globs);
     const [keptTest] = filterTestUnits(keptSkip);
+    // #565: never hand the authoring tier a conftest/fixture module either -- a
+    // generated "test for the fixture" is exactly the inversion the gate exists
+    // to prevent, except it also writes a file (measured: this surface proposed
+    // `scripts/otel_bootstrap/test_conftest_otel.py`).
+    const [keptSupport] = filterTestSupportUnits(keptTest);
+    // #562: nor a type-only module -- measured, this surface proposed writing
+    // `src/ConfirmModal/types.test.ts` to test an interface, a file whose only
+    // possible content is an assertion about nothing.
+    const [keptTyped] = filterTypeOnlyUnits(keptSupport, '.');
     const reexportPaths = findReexportOnly(diffText);
-    const kept = keptTest.filter((u) => !reexportPaths.has(u.path));
+    const kept = keptTyped.filter((u) => !reexportPaths.has(u.path));
     if (kept.length === 0)
         return [];
     const results = resolveCoverage(kept, { coveragePath, graphMaxDepth });