fastypest 3.0.41 → 3.0.44

package/.agents/specs/2026-08-08-actions-runtime-hardening.md

@@ -0,0 +1,44 @@
+# Actions runtime hardening
+
+## Request
+
+Investigate the failing npm auto-release and the shared required-QA Dependabot auto-merge automation, correct the root causes, and preserve the trusted release and approval contracts.
+
+## Evidence
+
+- Auto-release run `31248972629`, job `93082148311`, reached the package consumer smoke test and failed before publication because `actions/setup-node` exported an npm user config containing `${NODE_AUTH_TOKEN}` while npm trusted publishing intentionally provides no long-lived token. The temporary consumer then resolved Yarn Classic outside the repository and attempted to expand that undefined variable.
+- Required-QA workflows shared across the repository set attempt `enablePullRequestAutoMerge` even when GitHub reports a PR as `clean`; GitHub rejects that mutation because the PR can already merge.
+- Updating a behind Dependabot branch that changes `.github/workflows/*` can return `403` unless the automation token has the sensitive Workflows permission.
+- `GITHUB_TOKEN` must not perform an immediate merge when downstream `push` workflows are required because GitHub suppresses most workflow runs caused by that token.
+
+## Decision
+
+- Keep `.github/workflows/auto-release.workflow.yml` at the same path and retain npm OIDC with `id-token: write`; do not add an npm token fallback.
+- Isolate only the package-install smoke test from the publisher npm config and run its consumer install with the package-manager version declared by the package.
+- Keep current-head, non-bot, write-maintainer QA approval as the merge prerequisite and revalidate it immediately before mutation.
+- Use the protected `admin` Actions secret `PAT_FINE`, validated as the repository owner, for live branch/merge transitions so downstream events remain eligible to start workflows.
+- Never grant Workflows permission for branch refresh. A behind PR that changes workflows is reported as requiring a manual trusted branch update and a fresh approval.
+- If GitHub already reports `clean`, squash-merge the exact approved head. Otherwise enable repository auto-merge when available; handle a clean-state race by revalidating and merging the same exact head.
+
+## Acceptance
+
+- The npm smoke test no longer depends on `NODE_AUTH_TOKEN` and the OIDC publisher identity is unchanged.
+- Clean approved majors no longer fail the auto-merge mutation.
+- Workflow-changing behind majors do not request elevated workflow permission.
+- Stale approvals, bot approvals, changed heads, merge conflicts and change-request reviews cannot merge.
+- Dry-run remains non-mutating.
+
+## Checks
+
+- Parse changed workflow YAML.
+- Syntax-check shell and `github-script` programs.
+- Verify changed third-party Actions use immutable SHAs.
+- Pull-request CI is authoritative.
+
+## Rollback
+
+Revert the corrective pull request. No release, npm publish, merge, or deployment is performed by this branch.
+
+## Delivery status
+
+Implemented on `agent/fix-actions-runtime-20260808`; pending pull-request CI and explicit owner merge approval.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastypest",
-  "version": "3.0.41",
+  "version": "3.0.44",
   "description": "Restores the database automatically after each test. Allows serial execution of tests without having to delete and restore the database having to stop the application",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -58,30 +58,30 @@
     "@eslint/js": "^10.0.1",
     "@swc-node/jest": "^1.10.1",
     "@swc/cli": "^0.8.1",
-    "@swc/core": "^1.15.47",
+    "@swc/core": "^1.16.2",
     "@swc/helpers": "^0.5.23",
     "@types/jest": "^30.0.0",
-    "@types/node": "^26.1.2",
+    "@types/node": "^26.6.2",
     "@types/winston": "^2.4.4",
-    "@typescript-eslint/eslint-plugin": "^8.65.0",
-    "@typescript-eslint/parser": "^8.65.0",
-    "@typescript-eslint/types": "8.65.0",
+    "@typescript-eslint/eslint-plugin": "^8.70.0",
+    "@typescript-eslint/parser": "^8.70.0",
+    "@typescript-eslint/types": "8.70.0",
     "cpy-cli": "^6.0.0",
-    "eslint": "^10.8.0",
+    "eslint": "^10.11.0",
     "eslint-config-standard-with-typescript": "^43.0.1",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-n": "^18.2.2",
+    "eslint-plugin-n": "^18.3.0",
     "eslint-plugin-prettier": "^5.5.6",
     "eslint-plugin-promise": "^7.3.0",
     "execa": "^10.0.1",
-    "globals": "^17.9.0",
-    "jest": "^30.4.2",
-    "lefthook": "^2.1.10",
-    "lint-staged": "^17.3.0",
-    "mariadb": "^3.5.3",
+    "globals": "^17.12.0",
+    "jest": "^30.5.1",
+    "lefthook": "^2.1.14",
+    "lint-staged": "^17.5.1",
+    "mariadb": "^3.5.4",
     "mysql": "^2.18.1",
-    "pg": "^8.22.0",
-    "prettier": "^3.9.6",
+    "pg": "^8.23.0",
+    "prettier": "^3.9.8",
     "reflect-metadata": "^0.2.2",
     "rimraf": "^6.1.3",
     "standard-version": "^9.5.0",
@@ -89,7 +89,7 @@
     "tsconfig-paths": "^4.2.0",
     "typeorm": "^0.3.29",
     "typescript": "^5.9.3",
-    "typescript-eslint": "^8.65.0"
+    "typescript-eslint": "^8.70.0"
   },
   "peerDependencies": {
     "typeorm": "^0.3.29"