mandrel-platform 1.2.0 → 1.4.0

package/scripts/stryker-base-config.test.mjs

@@ -0,0 +1,256 @@
+#!/usr/bin/env node
+/**
+ * stryker-base-config.test.mjs — regression guard for the shared Stryker base
+ * config's bail and timeout shape.
+ *
+ * The bug this pins: with Stryker's default bail (`disableBail: false`), the
+ * vitest runner can mark a mutant Survived having completed zero tests — the
+ * mutant carries a non-empty covering-test list while its completed-test count
+ * is zero. A consumer measured 92 of 345 mutants flipping verdict between two
+ * identical runs, and a recorded score of 53.5% against a real 72.29%. A
+ * committed baseline taken under bail is therefore a floor under a number
+ * nothing measured: the gate is not merely noisy, it is wrong in the direction
+ * that hides surviving mutants.
+ *
+ * Disabling bail is not free — every mutant now runs its full covering set, so
+ * the run lengthens. The timeouts in this same base config must move with it,
+ * or the suite trades a wrong number for a silent overrun, and an overrun that
+ * preserves the prior result and exits clean is the same failure wearing a
+ * different mask. That coupling is why bail and the timeouts are asserted
+ * together here rather than in two independent tests: re-tightening either half
+ * alone reintroduces the defect.
+ *
+ * This repository ships the config but runs no mutation suite of its own, so
+ * the contract is asserted by shape. The run-to-run stability it buys is
+ * observable only in a consumer.
+ *
+ * The delivery half is asserted end-to-end rather than by shape: the suite
+ * imports the base through its published package specifier — the same
+ * resolution a consumer's `stryker.config.mjs` performs — and checks the
+ * settings that arrive. Stryker has no `extends` option (adjudicated against
+ * @stryker-mutator/core and @stryker-mutator/api 9.6.1), so the spread import
+ * is the only mechanism that delivers anything at all, and it is the only one
+ * documented.
+ *
+ * Run: node --test scripts/stryker-base-config.test.mjs
+ */
+
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { readFileSync } from "node:fs";
+
+const CONFIG_PATH = "config/stryker.base.json";
+const PACKAGE_PATH = "package.json";
+
+/**
+ * The specifier a consumer's `stryker.config.mjs` imports. Node resolves it
+ * through this package's own `exports` map (self-reference), so importing it
+ * here exercises the same resolution a consumer gets rather than a stand-in
+ * for it.
+ */
+const PACKAGE_SPECIFIER = "mandrel-platform/stryker.base.json";
+
+/** Stryker's own defaults, per https://stryker-mutator.io/docs/stryker-js/configuration. */
+const STRYKER_DEFAULTS = Object.freeze({
+  timeoutMS: 5000,
+  timeoutFactor: 1.5,
+  dryRunTimeoutMinutes: 5,
+});
+
+/**
+ * The timeout floor this config carried *before* bail was disabled. Bail
+ * cut every mutant's run short, so 60s absolute was survivable; without it the
+ * covering set runs to completion and the budget has to grow. Asserting
+ * strictly above the old value is what makes "raised alongside the bail
+ * change" mechanically checkable rather than a claim in a commit message.
+ */
+const PRE_CHANGE_TIMEOUT_MS = 60000;
+
+function readConfig() {
+  return JSON.parse(readFileSync(CONFIG_PATH, "utf8"));
+}
+
+test("base config disables bail so every mutant runs its full covering set", () => {
+  const config = readConfig();
+
+  assert.equal(
+    config.disableBail,
+    true,
+    `${CONFIG_PATH} must set "disableBail": true. Stryker defaults it to false, ` +
+      "and under bail the runner can score a mutant Survived having completed " +
+      "zero of its covering tests.",
+  );
+});
+
+test("timeouts are raised above both Stryker's defaults and the pre-change floor", async (t) => {
+  const config = readConfig();
+
+  await t.test("timeoutMS clears the pre-bail-change floor", () => {
+    assert.equal(
+      typeof config.timeoutMS,
+      "number",
+      `${CONFIG_PATH} must pin "timeoutMS" explicitly, not inherit it.`,
+    );
+    assert.ok(
+      config.timeoutMS > PRE_CHANGE_TIMEOUT_MS,
+      `"timeoutMS" is ${config.timeoutMS}; it must exceed the pre-change ` +
+        `${PRE_CHANGE_TIMEOUT_MS} because disabling bail lengthens every mutant's run.`,
+    );
+  });
+
+  await t.test("timeoutFactor is pinned above Stryker's default", () => {
+    assert.equal(
+      typeof config.timeoutFactor,
+      "number",
+      `${CONFIG_PATH} must pin "timeoutFactor" explicitly, not inherit it.`,
+    );
+    assert.ok(
+      config.timeoutFactor > STRYKER_DEFAULTS.timeoutFactor,
+      `"timeoutFactor" is ${config.timeoutFactor}; it must exceed Stryker's ` +
+        `${STRYKER_DEFAULTS.timeoutFactor} default so a full covering set is not ` +
+        "clipped as a false Timeout.",
+    );
+  });
+
+  await t.test("dryRunTimeoutMinutes is pinned above Stryker's default", () => {
+    assert.equal(
+      typeof config.dryRunTimeoutMinutes,
+      "number",
+      `${CONFIG_PATH} must pin "dryRunTimeoutMinutes" explicitly, not inherit it.`,
+    );
+    assert.ok(
+      config.dryRunTimeoutMinutes > STRYKER_DEFAULTS.dryRunTimeoutMinutes,
+      `"dryRunTimeoutMinutes" is ${config.dryRunTimeoutMinutes}; it must exceed ` +
+        `Stryker's ${STRYKER_DEFAULTS.dryRunTimeoutMinutes}-minute default.`,
+    );
+  });
+});
+
+test("a Timeout is not silently absorbed into the score", () => {
+  const config = readConfig();
+
+  // `ignoreStatic` legitimately drops static mutants from the denominator.
+  // Nothing else may: an option that reclassifies or suppresses a timed-out or
+  // errored mutant would let a run that overran still report the prior number
+  // and exit clean — the exact failure disabling bail is meant to end.
+  assert.equal(
+    Object.hasOwn(config, "maxTestRunnerReuse"),
+    false,
+    'Do not pin "maxTestRunnerReuse" in the shared base; it masks runner-level ' +
+      "instability that the timeout budget is supposed to surface.",
+  );
+  assert.notEqual(
+    config.allowEmpty,
+    true,
+    '"allowEmpty" must stay false/absent: a dry run that executed no tests must ' +
+      "fail loudly rather than score an empty suite.",
+  );
+});
+
+test("the documented spread-import mechanism delivers the bail-free settings", async () => {
+  // This is the consumer's own resolution path, not a proxy for it: the
+  // specifier below is resolved through the published `exports` map by Node,
+  // exactly as `stryker.config.mjs` in a consuming repo resolves it. Asserting
+  // the exports-map *string* instead would pass while the file it points at
+  // carried the wrong values, or while the entry was absent from `files` — the
+  // two ways the recipe can be documented correctly and still deliver nothing.
+  const { default: base } = await import(PACKAGE_SPECIFIER, {
+    with: { type: "json" },
+  });
+
+  assert.equal(
+    base.disableBail,
+    true,
+    `Importing "${PACKAGE_SPECIFIER}" must yield "disableBail": true. A consumer ` +
+      "spreading this object into stryker.config.mjs gets whatever this " +
+      "resolves to, so a broken export or a stale published file silently " +
+      "restores bail.",
+  );
+  assert.ok(
+    base.timeoutMS > PRE_CHANGE_TIMEOUT_MS,
+    `Importing "${PACKAGE_SPECIFIER}" must also carry the raised timeout budget ` +
+      `that bail-free runs need; got timeoutMS ${base.timeoutMS}.`,
+  );
+
+  // The exports map must reach *this* file, or the assertions in the rest of
+  // this suite are guarding a config no consumer receives.
+  assert.deepEqual(
+    base,
+    readConfig(),
+    `"${PACKAGE_SPECIFIER}" must resolve to ${CONFIG_PATH} — the file every ` +
+      "other test here asserts.",
+  );
+});
+
+test("the config declares no `extends`, which Stryker does not support", () => {
+  const config = readConfig();
+
+  // Adjudicated against @stryker-mutator/core 9.6.1 and @stryker-mutator/api
+  // 9.6.1: the config reader loads exactly one config file and deep-merges CLI
+  // arguments over it — there is no extends resolution step anywhere in it —
+  // and `extends` is absent from the 45 top-level properties in the published
+  // stryker-core.json schema. A base that advertises an `extends` recipe sends
+  // consumers down a path where the settings below arrive not at all.
+  assert.equal(
+    Object.hasOwn(config, "extends"),
+    false,
+    `${CONFIG_PATH} must not declare "extends". Stryker has no such option; ` +
+      "the supported mechanism is importing this file by its package " +
+      "specifier and spreading it (see the README).",
+  );
+});
+
+test("annotations use the `_comment` suffix Stryker's validator exempts", () => {
+  const config = readConfig();
+
+  // Stryker warns "Unknown stryker config option \"<key>\"" for any top-level
+  // key that is neither in its schema nor suffixed `_comment`. A prefix-named
+  // key like `_comment_disableBail` fails that suffix check, so documenting
+  // the base costs every consumer a warning on every run.
+  const STRYKER_OPTIONS = new Set([
+    "$schema",
+    "packageManager",
+    "reporters",
+    "coverageAnalysis",
+    "ignoreStatic",
+    "cleanTempDir",
+    "disableBail",
+    "timeoutMS",
+    "timeoutFactor",
+    "dryRunTimeoutMinutes",
+    "thresholds",
+  ]);
+
+  const wouldWarn = Object.keys(config).filter(
+    (key) => !STRYKER_OPTIONS.has(key) && !key.endsWith("_comment"),
+  );
+
+  assert.deepEqual(
+    wouldWarn,
+    [],
+    `${CONFIG_PATH} keys ${JSON.stringify(wouldWarn)} are neither pinned Stryker ` +
+      'options nor suffixed "_comment", so Stryker reports each as an unknown ' +
+      "config option in every consumer run. Rename annotations to " +
+      "`<topic>_comment`.",
+  );
+});
+
+test("every pinned Stryker option is still exported to consumers", () => {
+  const pkg = JSON.parse(readFileSync(PACKAGE_PATH, "utf8"));
+
+  // The import test above proves resolution works *here*, where Node's
+  // self-reference falls back to the local file. Publication is what carries it
+  // to a consumer, and that needs both the exports entry and the files
+  // allowlist.
+  assert.equal(
+    pkg.exports["./stryker.base.json"],
+    `./${CONFIG_PATH}`,
+    "The ./stryker.base.json export must point at the file this test asserts, " +
+      "or consumers import a config nothing guards.",
+  );
+  assert.ok(
+    pkg.files.includes("config/"),
+    'The "files" allowlist must publish config/, or the export resolves to a ' +
+      "file absent from the tarball.",
+  );
+});

package/scripts/track-issue.test.mjs

@@ -0,0 +1,375 @@
+// Unit coverage for the generic single-issue failure tracker (Story #389).
+//
+// The whole point of this action is a SINGLE tracked issue that does not spam:
+// it must open once, stay quiet while the failing set is unchanged, update only
+// on a real change, and close when the set clears. That contract is the pure
+// `decideVerdict` function — these tests pin every branch of it, plus the
+// failing-set derivation, the digest, the marker round-trip and the gh-driven
+// lookup, without any network access.
+//
+// Run: node --test scripts/track-issue.test.mjs
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  DEFAULT_CLOSE_COMMENT,
+  DEFAULT_INTRO,
+  buildIssueBody,
+  computeDigest,
+  decideVerdict,
+  defaultDigestPrefix,
+  digestMarker,
+  extractDigest,
+  failingJobs,
+  findTrackingIssue,
+  markerKey,
+  markerLine,
+  renderEnvEntry,
+  resolveConfig,
+} from "../.github/actions/track-issue/track-issue.mjs";
+
+const MARKER = "acme:nightly-tracker";
+const PREFIX = defaultDigestPrefix(MARKER);
+const OPTS = { digestPrefix: PREFIX };
+
+/** An open tracked issue whose body carries `digest`. */
+const issueWithDigest = (number, digest) => ({
+  number,
+  body: buildIssueBody({ marker: MARKER, digestPrefix: PREFIX, digest, detail: "…" }),
+});
+
+// ---------------------------------------------------------------------------
+// AC-3 — the four-way state machine survives the extraction unchanged
+// ---------------------------------------------------------------------------
+
+test("CREATE when items are failing and no tracking issue is open", () => {
+  const v = decideVerdict(null, { failedCount: 2, digest: "abcd1234" }, OPTS);
+  assert.equal(v.action, "create");
+});
+
+test("UPDATE when the failing-set digest changed since the issue was written", () => {
+  const existing = issueWithDigest(42, "abcd1234");
+  const v = decideVerdict(existing, { failedCount: 3, digest: "zzzz9999" }, OPTS);
+  assert.equal(v.action, "update");
+});
+
+test("CLOSE when the failing set is now empty but an issue is still open", () => {
+  const existing = issueWithDigest(42, "abcd1234");
+  const v = decideVerdict(existing, { failedCount: 0, digest: "green-0" }, OPTS);
+  assert.equal(v.action, "close");
+});
+
+test("NOOP when nothing is failing and there is no issue to close", () => {
+  const v = decideVerdict(null, { failedCount: 0, digest: "green-0" }, OPTS);
+  assert.equal(v.action, "noop");
+});
+
+// ---------------------------------------------------------------------------
+// AC-4 — the never-a-second-issue invariant, asserted on the core
+// ---------------------------------------------------------------------------
+
+test("two consecutive failing runs against an open marked issue never yield CREATE", () => {
+  // Run 1 opens the issue; the tracker then finds it on every subsequent run.
+  assert.equal(decideVerdict(null, { failedCount: 1, digest: "d1" }, OPTS).action, "create");
+  const open = issueWithDigest(7, "d1");
+
+  // Run 2 — same failing set. Run 3 — a DIFFERENT failing set. Neither may
+  // create: a second issue is the duplicate-spam failure this action prevents.
+  const second = decideVerdict(open, { failedCount: 1, digest: "d1" }, OPTS);
+  const third = decideVerdict(open, { failedCount: 4, digest: "d2" }, OPTS);
+
+  assert.equal(second.action, "noop");
+  assert.equal(third.action, "update");
+  for (const v of [second, third]) assert.notEqual(v.action, "create");
+});
+
+test("an unparseable body never yields CREATE while an issue is open", () => {
+  // A human editing the body away is not a licence to open a second issue: the
+  // marker still found the issue, so the worst case is a redundant UPDATE.
+  const mangled = { number: 9, body: "someone deleted the digest marker" };
+  assert.equal(decideVerdict(mangled, { failedCount: 2, digest: "d9" }, OPTS).action, "update");
+});
+
+// ---------------------------------------------------------------------------
+// AC-5 — only `failure` counts; cancelled/skipped are not failures
+// ---------------------------------------------------------------------------
+
+test("failingJobs counts only entries whose result is exactly `failure`", () => {
+  const needs = {
+    build: { result: "success" },
+    test: { result: "failure" },
+    deploy: { result: "cancelled" },
+    docs: { result: "skipped" },
+    lint: { result: "failure" },
+  };
+  assert.deepEqual(failingJobs(needs), ["lint", "test"]);
+});
+
+test("a job-results payload of only cancelled/skipped never yields CREATE", () => {
+  // A self-hosted fleet going down produces a wall of `cancelled` — raising an
+  // issue for that is precisely the noise this tracker exists to avoid.
+  const noise = { a: { result: "cancelled" }, b: { result: "skipped" }, c: { result: "success" } };
+  const failed = failingJobs(noise);
+  assert.deepEqual(failed, []);
+
+  const digest = computeDigest(failed);
+  assert.equal(
+    decideVerdict(null, { failedCount: failed.length, digest }, OPTS).action,
+    "noop",
+    "no open issue → nothing to do",
+  );
+  assert.equal(
+    decideVerdict(issueWithDigest(3, "d1"), { failedCount: failed.length, digest }, OPTS).action,
+    "close",
+    "an open issue is closed, because nothing is actually failing",
+  );
+});
+
+test("resolveConfig derives an empty failing set from an all-cancelled job payload", () => {
+  const cfg = resolveConfig({
+    TRACK_MARKER: MARKER,
+    TRACK_REPO: "acme/app",
+    TRACK_JOB_RESULTS: JSON.stringify({ a: { result: "cancelled" }, b: { result: "skipped" } }),
+  });
+  assert.deepEqual(cfg.failedItems, []);
+  assert.equal(cfg.digest, "green-0");
+});
+
+// ---------------------------------------------------------------------------
+// AC-6 — unchanged-set behaviour is selectable, defaulting to today's posture
+// ---------------------------------------------------------------------------
+
+test("an unchanged digest is NOOP by default", () => {
+  const existing = issueWithDigest(42, "same-digest");
+  const v = decideVerdict(existing, { failedCount: 2, digest: "same-digest" }, OPTS);
+  assert.equal(v.action, "noop");
+  assert.equal(v.changed, false);
+});
+
+test("the same unchanged digest is UPDATE under `unchanged-behavior: refresh`", () => {
+  const existing = issueWithDigest(42, "same-digest");
+  const v = decideVerdict(
+    existing,
+    { failedCount: 2, digest: "same-digest" },
+    { ...OPTS, unchangedBehavior: "refresh" },
+  );
+  assert.equal(v.action, "update");
+  assert.equal(v.changed, false, "a refresh is not a change — it must not fire a change comment");
+});
+
+test("resolveConfig defaults unchanged-behavior to noop and rejects an unknown value", () => {
+  const base = { TRACK_MARKER: MARKER, TRACK_REPO: "acme/app" };
+  assert.equal(resolveConfig(base).unchangedBehavior, "noop");
+  assert.equal(resolveConfig({ ...base, TRACK_UNCHANGED_BEHAVIOR: "refresh" }).unchangedBehavior, "refresh");
+  assert.equal(
+    resolveConfig({ ...base, TRACK_UNCHANGED_BEHAVIOR: "shout" }).unchangedBehavior,
+    "noop",
+    "an unrecognised value falls back to the quiet posture rather than spamming",
+  );
+});
+
+// ---------------------------------------------------------------------------
+// Marker + digest contract
+// ---------------------------------------------------------------------------
+
+test("the action owns both marker lines and they round-trip through a body", () => {
+  const body = buildIssueBody({
+    marker: MARKER,
+    digestPrefix: PREFIX,
+    digest: "deadbeef",
+    intro: "watching the nightly",
+    detail: "one job is red",
+  });
+
+  assert.ok(body.includes(markerLine(MARKER)));
+  assert.equal(extractDigest(body, PREFIX), "deadbeef");
+  assert.equal(extractDigest("no markers here", PREFIX), null);
+  assert.match(body, /watching the nightly/);
+  assert.match(body, /one job is red/);
+});
+
+test("a marker supplied as a rendered comment is not double-wrapped", () => {
+  // A caller that hands over `<!-- k -->` must still produce `<!-- k -->` —
+  // a double-wrapped marker would never match the live issue again.
+  assert.equal(markerKey("<!-- acme:x -->"), "acme:x");
+  assert.equal(markerLine("<!-- acme:x -->"), "<!-- acme:x -->");
+});
+
+test("the legacy `--!>` comment terminator is stripped, not left in the key", () => {
+  // `--!>` closes an HTML comment just as `-->` does. A stripper blind to it
+  // leaves a stray `!` in the key, so the rendered marker stops matching the
+  // live issue and the next run opens a second one.
+  assert.equal(markerKey("<!-- acme:x --!>"), "acme:x");
+  assert.equal(markerLine("<!-- acme:x --!>"), "<!-- acme:x -->");
+});
+
+test("a digest marker closed with `--!>` is still recovered", () => {
+  assert.equal(extractDigest("<!-- acme:d: abc123 --!>", "acme:d:"), "abc123");
+});
+
+test("extractDigest skips non-matching comments and needs a single token", () => {
+  const body = [
+    "<!-- acme:nightly-tracker -->",
+    "<!-- unrelated: note -->",
+    "<!-- acme:d: two tokens -->",
+    "<!-- acme:d: realdigest -->",
+  ].join("\n");
+  assert.equal(extractDigest(body, "acme:d:"), "realdigest");
+  assert.equal(extractDigest("<!-- acme:d: -->", "acme:d:"), null);
+  assert.equal(extractDigest("<!-- acme:d: unterminated", "acme:d:"), null);
+});
+
+test("the digest prefix defaults from the marker but is overridable", () => {
+  assert.equal(defaultDigestPrefix(MARKER), "acme:nightly-tracker-digest:");
+  assert.match(digestMarker("abc", "custom:pfx:"), /<!-- custom:pfx: abc -->/);
+  assert.equal(extractDigest(digestMarker("abc", "custom:pfx:"), "custom:pfx:"), "abc");
+});
+
+test("a regex-special digest prefix is matched literally, not as a pattern", () => {
+  const prefix = "acme(v1).digest:";
+  assert.equal(extractDigest(digestMarker("xyz", prefix), prefix), "xyz");
+  assert.equal(extractDigest("<!-- acmeXv1Yxdigest: xyz -->", prefix), null);
+});
+
+test("body defaults fill in when the caller supplies no prose", () => {
+  const body = buildIssueBody({ marker: MARKER, digestPrefix: PREFIX, digest: "d" });
+  assert.ok(body.includes(DEFAULT_INTRO));
+  assert.match(body, /_\(no detail provided\)_/);
+  assert.ok(!body.includes("Latest run:"), "an absent run-url omits the line entirely");
+});
+
+test("a run-url is rendered only when supplied", () => {
+  const body = buildIssueBody({
+    marker: MARKER,
+    digestPrefix: PREFIX,
+    digest: "d",
+    runUrl: "https://example.invalid/run/1",
+  });
+  assert.match(body, /Latest run: https:\/\/example\.invalid\/run\/1/);
+});
+
+// ---------------------------------------------------------------------------
+// Digest derivation
+// ---------------------------------------------------------------------------
+
+test("computeDigest is order-independent and de-duplicating", () => {
+  assert.equal(computeDigest(["b", "a"]), computeDigest(["a", "b"]));
+  assert.equal(computeDigest(["a", "a", "b"]), computeDigest(["a", "b"]));
+  assert.notEqual(computeDigest(["a"]), computeDigest(["a", "b"]));
+  assert.match(computeDigest(["a"]), /^[0-9a-f]{12}$/);
+});
+
+test("computeDigest marks an empty set legibly rather than hashing nothing", () => {
+  assert.equal(computeDigest([]), "green-0");
+  assert.equal(computeDigest(undefined), "green-0");
+});
+
+// ---------------------------------------------------------------------------
+// Environment contract
+// ---------------------------------------------------------------------------
+
+test("failed-items takes precedence over job-results when both are supplied", () => {
+  const cfg = resolveConfig({
+    TRACK_MARKER: MARKER,
+    TRACK_REPO: "acme/app",
+    TRACK_FAILED_ITEMS: JSON.stringify(["explicit"]),
+    TRACK_JOB_RESULTS: JSON.stringify({ ignored: { result: "failure" } }),
+  });
+  assert.deepEqual(cfg.failedItems, ["explicit"]);
+});
+
+test("an explicit digest wins over the derived one", () => {
+  const cfg = resolveConfig({
+    TRACK_MARKER: MARKER,
+    TRACK_REPO: "acme/app",
+    TRACK_FAILED_ITEMS: JSON.stringify(["a"]),
+    TRACK_DIGEST: "caller-supplied",
+  });
+  assert.equal(cfg.digest, "caller-supplied");
+});
+
+test("malformed failed-items is an error, not a silently-empty failing set", () => {
+  // Swallowing a parse error here would CLOSE a live tracked issue while the
+  // failures it names are still happening.
+  const cfg = resolveConfig({
+    TRACK_MARKER: MARKER,
+    TRACK_REPO: "acme/app",
+    TRACK_FAILED_ITEMS: "{not json",
+  });
+  assert.match(cfg.error, /TRACK_FAILED_ITEMS/);
+
+  const notAnArray = resolveConfig({
+    TRACK_MARKER: MARKER,
+    TRACK_REPO: "acme/app",
+    TRACK_FAILED_ITEMS: '{"a":1}',
+  });
+  assert.match(notAnArray.error, /JSON string array/);
+});
+
+test("malformed job-results is an error rather than an empty failing set", () => {
+  const cfg = resolveConfig({
+    TRACK_MARKER: MARKER,
+    TRACK_REPO: "acme/app",
+    TRACK_JOB_RESULTS: "{not json",
+  });
+  assert.match(cfg.error, /TRACK_JOB_RESULTS/);
+});
+
+test("resolveConfig splits labels and defaults the quiet knobs", () => {
+  const cfg = resolveConfig({
+    TRACK_MARKER: MARKER,
+    TRACK_REPO: "acme/app",
+    TRACK_LABELS: " ci , ,tracking ",
+  });
+  assert.deepEqual(cfg.labels, ["ci", "tracking"]);
+  assert.equal(cfg.commentOnChange, false);
+  assert.equal(cfg.dryRun, false);
+  assert.equal(cfg.branch, "main");
+  assert.equal(cfg.closeComment, DEFAULT_CLOSE_COMMENT);
+});
+
+test("renderEnvEntry escalates a multi-line value to the heredoc form", () => {
+  assert.equal(renderEnvEntry("K", "one"), "K=one\n");
+  const multi = renderEnvEntry("K", "one\ntwo");
+  assert.match(multi, /^K<<K_EOF_7f3a\none\ntwo\nK_EOF_7f3a\n$/);
+  assert.throws(() => renderEnvEntry("K", "a\nK_EOF_7f3a"), /delimiter/);
+});
+
+// ---------------------------------------------------------------------------
+// gh lookup
+// ---------------------------------------------------------------------------
+
+test("findTrackingIssue confirms the marker rather than trusting the search hint", () => {
+  const calls = [];
+  const runner = (args, opts) => {
+    calls.push({ args, opts });
+    // gh's `in:body` search is fuzzy — return one true match and one false positive.
+    return JSON.stringify([
+      { number: 99, body: "unrelated issue mentioning nightly-tracker in prose" },
+      { number: 100, body: `${markerLine(MARKER)}\n${digestMarker("x-1", PREFIX)}\nbody` },
+    ]);
+  };
+
+  const found = findTrackingIssue({ repo: "acme/app", labels: ["ci"], marker: MARKER }, runner);
+
+  assert.equal(found.number, 100);
+  assert.ok(calls[0].args.includes("--label"));
+  assert.ok(calls[0].args.includes("ci"));
+});
+
+test("findTrackingIssue returns null when nothing carries the marker", () => {
+  const runner = () => JSON.stringify([{ number: 1, body: "no marker" }]);
+  assert.equal(findTrackingIssue({ repo: "acme/app", labels: [], marker: MARKER }, runner), null);
+});
+
+test("findTrackingIssue surfaces a gh failure rather than reporting no issue", () => {
+  // Reporting "no issue" on a failed lookup would open a duplicate.
+  const runner = () => {
+    throw new Error("gh: not authenticated");
+  };
+  assert.throws(
+    () => findTrackingIssue({ repo: "acme/app", labels: [], marker: MARKER }, runner),
+    /gh issue list failed/,
+  );
+});