pi-usereq 0.4.0

package/tests/helpers.ts

@@ -0,0 +1,204 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
+import {
+  DEFAULT_DOCS_DIR,
+  getDefaultConfig,
+  getProjectConfigPath,
+  saveConfig,
+  type UseReqConfig,
+} from "../src/core/config.js";
+import { normalizeEnabledPiUsereqTools } from "../src/core/pi-usereq-tools.js";
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const TSX_LOADER = require.resolve("tsx", { paths: [ROOT] });
+const ORACLE_VENV_PYTHON = path.join(ROOT, ".venv-oracle", "bin", "python");
+const PYTHON = fs.existsSync(ORACLE_VENV_PYTHON) ? ORACLE_VENV_PYTHON : "python3";
+const ORACLE_SRC = fs.existsSync(path.join(ROOT, "temp", "usereq", "src"))
+  ? path.join(ROOT, "temp", "usereq", "src")
+  : path.join(ROOT, "..", "PI-useReq", "temp", "usereq", "src");
+const FIXTURES_DIR = path.join(ROOT, "tests", "fixtures");
+
+export function getFixtureFiles(): string[] {
+  return fs
+    .readdirSync(FIXTURES_DIR)
+    .filter((entry) => entry.startsWith("fixture_"))
+    .map((entry) => path.join(FIXTURES_DIR, entry))
+    .sort();
+}
+
+/**
+ * @brief Executes the TypeScript CLI in a subprocess.
+ * @details Invokes `node --import tsx src/cli.ts` with the supplied arguments, cwd, and environment overrides while preserving the oracle Python interpreter binding. Runtime is dominated by child-process execution. Side effects are limited to subprocess creation.
+ * @param[in] args {string[]} CLI arguments forwarded to `src/cli.ts`.
+ * @param[in] cwd {string} Working directory for the child process.
+ * @param[in] envOverrides {NodeJS.ProcessEnv | undefined} Optional environment additions or overrides.
+ * @return {import("node:child_process").SpawnSyncReturns<string>} Captured process result.
+ */
+export function runNodeCli(args: string[], cwd = ROOT, envOverrides?: NodeJS.ProcessEnv) {
+  return spawnSync("node", ["--import", TSX_LOADER, path.join(ROOT, "src", "cli.ts"), ...args], {
+    cwd,
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      PI_USEREQ_PYTHON: PYTHON,
+      ...envOverrides,
+    },
+  });
+}
+
+/**
+ * @brief Executes the Python oracle CLI in a subprocess.
+ * @details Invokes `python -m usereq.cli` with the supplied arguments, cwd, and environment overrides while preserving the oracle `PYTHONPATH`. Runtime is dominated by child-process execution. Side effects are limited to subprocess creation.
+ * @param[in] args {string[]} CLI arguments forwarded to the oracle module.
+ * @param[in] cwd {string} Working directory for the child process.
+ * @param[in] envOverrides {NodeJS.ProcessEnv | undefined} Optional environment additions or overrides.
+ * @return {import("node:child_process").SpawnSyncReturns<string>} Captured process result.
+ */
+export function runPythonCli(args: string[], cwd = ROOT, envOverrides?: NodeJS.ProcessEnv) {
+  assert.ok(fs.existsSync(ORACLE_SRC), `Python oracle source not found at ${ORACLE_SRC}`);
+  return spawnSync(PYTHON, ["-m", "usereq.cli", ...args], {
+    cwd,
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      PYTHONPATH: ORACLE_SRC,
+      ...envOverrides,
+    },
+  });
+}
+
+/**
+ * @brief Executes inline Python code with the oracle module search path.
+ * @details Invokes the oracle interpreter with `-c`, preserves `PYTHONPATH` for `usereq` imports, and returns the captured subprocess result. Runtime is dominated by child-process execution. Side effects are limited to subprocess creation.
+ * @param[in] code {string} Inline Python program.
+ * @param[in] cwd {string} Working directory for the child process.
+ * @param[in] envOverrides {NodeJS.ProcessEnv | undefined} Optional environment additions or overrides.
+ * @return {import("node:child_process").SpawnSyncReturns<string>} Captured process result.
+ */
+export function runPythonInline(code: string, cwd = ROOT, envOverrides?: NodeJS.ProcessEnv) {
+  assert.ok(fs.existsSync(ORACLE_SRC), `Python oracle source not found at ${ORACLE_SRC}`);
+  return spawnSync(PYTHON, ["-c", code], {
+    cwd,
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      PYTHONPATH: ORACLE_SRC,
+      ...envOverrides,
+    },
+  });
+}
+
+export function createTempDir(prefix: string): string {
+  return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+}
+
+/**
+ * @brief Persists the Python oracle configuration mirror for one fixture project.
+ * @details Writes `.req/config.json` with the supplied config plus the oracle-specific `guidelines-dir` field so Node and Python parity tests observe the same project metadata. Runtime is O(n) in serialized config size. Side effects include directory creation and file overwrite.
+ * @param[in] projectBase {string} Fixture project root.
+ * @param[in] config {UseReqConfig} Effective project configuration to mirror.
+ * @return {void} No return value.
+ */
+function writeOracleReqConfig(projectBase: string, config: UseReqConfig): void {
+  const reqDir = path.join(projectBase, ".req");
+  fs.mkdirSync(reqDir, { recursive: true });
+  const payload = {
+    "guidelines-dir": "guidelines",
+    ...config,
+  };
+  fs.writeFileSync(path.join(reqDir, "config.json"), `${JSON.stringify(payload, null, 2)}\n`, "utf8");
+}
+
+/**
+ * @brief Persists both Node and Python-oracle project configs for parity tests.
+ * @details Writes `.pi-usereq/config.json` for the TypeScript CLI and `.req/config.json` for the Python oracle using the same logical payload. Runtime is O(n) in serialized config size. Side effects include directory creation and file overwrite.
+ * @param[in] projectBase {string} Fixture project root.
+ * @param[in] config {UseReqConfig} Effective project configuration to persist.
+ * @return {void} No return value.
+ */
+export function saveFixtureConfigs(projectBase: string, config: UseReqConfig): void {
+  saveConfig(projectBase, config);
+  writeOracleReqConfig(projectBase, config);
+}
+
+/**
+ * @brief Reads the raw persisted TypeScript project config JSON.
+ * @details Loads `.pi-usereq/config.json` without normalization so tests can inspect merge order and unknown metadata preservation exactly as written. Runtime is O(n) in file size. Side effects are limited to filesystem reads.
+ * @param[in] projectBase {string} Fixture project root.
+ * @return {Record<string, unknown>} Parsed raw configuration object.
+ */
+export function readProjectConfigJson(projectBase: string): Record<string, unknown> {
+  return JSON.parse(fs.readFileSync(getProjectConfigPath(projectBase), "utf8")) as Record<string, unknown>;
+}
+
+/**
+ * @brief Writes one executable shell script for integration tests.
+ * @details Creates the parent directory when required, writes UTF-8 content, and marks the file owner-executable. Runtime is O(n) in script size. Side effects include directory creation, file overwrite, and permission changes.
+ * @param[in] filePath {string} Absolute destination path for the script.
+ * @param[in] content {string} Full script body.
+ * @return {string} Absolute script path.
+ */
+export function writeExecutableScript(filePath: string, content: string): string {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, content, "utf8");
+  fs.chmodSync(filePath, 0o755);
+  return filePath;
+}
+
+export function initFixtureRepo(options: {
+  fixtures?: string[];
+  docs?: Record<string, string>;
+  staticCheck?: Record<string, Array<{ module: string; cmd?: string; params?: string[] }>>;
+} = {}): { projectBase: string; config: UseReqConfig } {
+  const projectBase = createTempDir("pi-usereq-repo-");
+  fs.mkdirSync(path.join(projectBase, "src"), { recursive: true });
+  fs.mkdirSync(path.join(projectBase, "tests"), { recursive: true });
+  fs.mkdirSync(path.join(projectBase, "guidelines"), { recursive: true });
+  fs.mkdirSync(path.join(projectBase, ...DEFAULT_DOCS_DIR.split("/")), { recursive: true });
+  fs.mkdirSync(path.join(projectBase, ".pi-usereq"), { recursive: true });
+
+  for (const fixture of options.fixtures ?? getFixtureFiles()) {
+    const destination = path.join(projectBase, "src", path.basename(fixture));
+    fs.copyFileSync(fixture, destination);
+  }
+
+  const docs = options.docs ?? {
+    "REQUIREMENTS.md": "# Requirements\n",
+    "WORKFLOW.md": "# Workflow\n",
+    "REFERENCES.md": "# References\n",
+  };
+  for (const [name, content] of Object.entries(docs)) {
+    fs.writeFileSync(path.join(projectBase, ...DEFAULT_DOCS_DIR.split("/"), name), content, "utf8");
+  }
+
+  const gitInit = spawnSync("git", ["init"], { cwd: projectBase, encoding: "utf8" });
+  assert.equal(gitInit.status, 0, gitInit.stderr);
+  spawnSync("git", ["config", "user.name", "pi-usereq"], { cwd: projectBase, encoding: "utf8" });
+  spawnSync("git", ["config", "user.email", "pi-usereq@example.com"], { cwd: projectBase, encoding: "utf8" });
+  spawnSync("git", ["add", "."], { cwd: projectBase, encoding: "utf8" });
+  const commit = spawnSync("git", ["commit", "-m", "init"], { cwd: projectBase, encoding: "utf8" });
+  assert.equal(commit.status, 0, commit.stderr);
+  const config: UseReqConfig = {
+    ...getDefaultConfig(projectBase),
+    "docs-dir": DEFAULT_DOCS_DIR,
+    "tests-dir": "tests",
+    "src-dir": ["src"],
+    "static-check": options.staticCheck ?? {},
+    "enabled-tools": normalizeEnabledPiUsereqTools(undefined),
+  };
+  saveFixtureConfigs(projectBase, config);
+
+  const localVenv = path.join(projectBase, ".venv");
+  const oracleVenvRoot = path.dirname(path.dirname(ORACLE_VENV_PYTHON));
+  if (!fs.existsSync(localVenv) && fs.existsSync(oracleVenvRoot)) {
+    fs.symlinkSync(oracleVenvRoot, localVenv, "dir");
+  }
+
+  return { projectBase, config };
+}

package/tests/oracle-project.test.ts

@@ -0,0 +1,63 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { getProjectConfigPath } from "../src/core/config.js";
+import { LANGUAGE_TAGS } from "../src/core/find-constructs.js";
+import { initFixtureRepo, runNodeCli, runPythonCli } from "./helpers.js";
+
+function compareCli(args: string[], cwd: string) {
+  const python = runPythonCli(args, cwd);
+  const node = runNodeCli(args, cwd);
+  assert.equal(node.status, python.status, `exit code mismatch for ${args.join(" ")}`);
+  assert.equal(node.stdout, python.stdout, `stdout mismatch for ${args.join(" ")}`);
+  assert.equal(node.stderr, python.stderr, `stderr mismatch for ${args.join(" ")}`);
+}
+
+test("project-scan commands match the Python oracle on a git-backed fixture repository", async (t) => {
+  const { projectBase } = initFixtureRepo({
+    staticCheck: {
+      Python: [{ module: "Command", cmd: "false" }],
+    },
+  });
+
+  await t.test("compress", () => compareCli(["--compress"], projectBase));
+  await t.test("compress with line numbers", () => compareCli(["--compress", "--enable-line-numbers"], projectBase));
+  await t.test("find", () => {
+    const tagFilter = [...LANGUAGE_TAGS.python].sort().join("|");
+    compareCli(["--find", tagFilter, ".*"], projectBase);
+  });
+  await t.test("tokens", () => compareCli(["--tokens"], projectBase));
+  await t.test("files-static-check", () => compareCli(["--files-static-check", path.join(projectBase, "src", "fixture_python.py")], projectBase));
+  await t.test("static-check", () => compareCli(["--static-check"], projectBase));
+  await t.test("git-check", () => compareCli(["--git-check"], projectBase));
+  await t.test("docs-check", () => compareCli(["--docs-check"], projectBase));
+  await t.test("git-path", () => compareCli(["--git-path"], projectBase));
+  await t.test("get-base-path", () => compareCli(["--get-base-path"], projectBase));
+  await t.test("git-wt-name", () => {
+    let matched = false;
+    for (let attempt = 0; attempt < 3 && !matched; attempt += 1) {
+      const python = runPythonCli(["--git-wt-name"], projectBase);
+      const node = runNodeCli(["--git-wt-name"], projectBase);
+      if (python.stdout === node.stdout && python.status === node.status && python.stderr === node.stderr) {
+        matched = true;
+      }
+    }
+    assert.ok(matched, "git-wt-name did not match Python oracle within 3 attempts");
+  });
+});
+
+test("git worktree create/delete wrappers produce expected worktree side effects", () => {
+  const { projectBase } = initFixtureRepo();
+  const wtName = "pi-usereq-test-wt";
+
+  const createResult = runNodeCli(["--git-wt-create", wtName], projectBase);
+  assert.equal(createResult.status, 0, createResult.stderr);
+  const worktreePath = path.join(path.dirname(projectBase), wtName);
+  assert.ok(fs.existsSync(worktreePath), "worktree path was not created");
+  assert.ok(fs.existsSync(getProjectConfigPath(worktreePath)), "project config was not copied into worktree");
+
+  const deleteResult = runNodeCli(["--git-wt-delete", wtName], projectBase);
+  assert.equal(deleteResult.status, 0, deleteResult.stderr);
+  assert.ok(!fs.existsSync(worktreePath), "worktree path was not removed");
+});

package/tests/oracle-standalone.test.ts

@@ -0,0 +1,48 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import path from "node:path";
+import { LANGUAGE_TAGS } from "../src/core/find-constructs.js";
+import { detectLanguage } from "../src/core/generate-markdown.js";
+import { getFixtureFiles, runNodeCli, runPythonCli } from "./helpers.js";
+
+function compareCli(args: string[]) {
+  const python = runPythonCli(args);
+  const node = runNodeCli(args);
+  assert.equal(node.status, python.status, `exit code mismatch for ${args.join(" ")}`);
+  assert.equal(node.stdout, python.stdout, `stdout mismatch for ${args.join(" ")}`);
+  assert.equal(node.stderr, python.stderr, `stderr mismatch for ${args.join(" ")}`);
+}
+
+test("standalone command outputs match the Python oracle for every fixture", async (t) => {
+  const fixtures = getFixtureFiles();
+  for (const fixture of fixtures) {
+    const fileName = path.basename(fixture);
+    await t.test(`files-tokens ${fileName}`, () => {
+      compareCli(["--files-tokens", fixture]);
+    });
+    await t.test(`files-compress ${fileName}`, () => {
+      compareCli(["--files-compress", fixture]);
+    });
+    await t.test(`files-compress --enable-line-numbers ${fileName}`, () => {
+      compareCli(["--files-compress", fixture, "--enable-line-numbers"]);
+    });
+    await t.test(`files-find ${fileName}`, () => {
+      const language = detectLanguage(fixture);
+      assert.ok(language);
+      const tagFilter = [...LANGUAGE_TAGS[language!]!].sort().join("|");
+      compareCli(["--files-find", tagFilter, ".*", fixture]);
+    });
+    await t.test(`test-static-check dummy ${fileName}`, () => {
+      compareCli(["--test-static-check", "dummy", fixture]);
+    });
+    await t.test(`test-static-check pylance ${fileName}`, () => {
+      compareCli(["--test-static-check", "pylance", fixture]);
+    });
+    await t.test(`test-static-check ruff ${fileName}`, () => {
+      compareCli(["--test-static-check", "ruff", fixture]);
+    });
+    await t.test(`test-static-check command ${fileName}`, () => {
+      compareCli(["--test-static-check", "command", "false", fixture]);
+    });
+  }
+});

package/tests/prompt-rendering.test.ts

@@ -0,0 +1,66 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { getDefaultConfig } from "../src/core/config.js";
+import { buildRuntimePathContext, buildRuntimePathFacts } from "../src/core/path-context.js";
+import { renderPrompt } from "../src/core/prompts.js";
+import { ensureBundledResourcesAccessible } from "../src/core/resources.js";
+
+/**
+ * @brief Escapes regular-expression metacharacters for literal-path assertions.
+ * @details Replaces every regex-significant character with an escaped fragment so tests can assert exact rendered path strings without interpreting path punctuation as pattern syntax. Runtime is O(n) in input length. No external state is mutated.
+ * @param[in] value {string} Literal string to escape.
+ * @return {string} Regex-safe literal fragment.
+ */
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+test("installed bundled resources remain readable from the installation path", () => {
+  const resourceRoot = ensureBundledResourcesAccessible();
+  assert.ok(fs.existsSync(path.join(resourceRoot, "prompts", "analyze.md")));
+  assert.ok(fs.existsSync(path.join(resourceRoot, "templates", "Requirements_Template.md")));
+  assert.ok(fs.existsSync(path.join(resourceRoot, "guidelines", "Google_Python_Style_Guide.md")));
+});
+
+test("prompt rendering replaces all dynamic placeholders and adapts req tool references", () => {
+  ensureBundledResourcesAccessible();
+  const projectBase = process.cwd();
+  const config = getDefaultConfig(projectBase);
+  config["src-dir"] = ["src", "scripts", ".github/workflows"];
+  config["tests-dir"] = "tests";
+  const runtimePathFacts = buildRuntimePathFacts(buildRuntimePathContext(projectBase, config));
+  const rendered = renderPrompt("write", "Build a CLI parser", projectBase, config);
+  assert.match(rendered, /Build a CLI parser/);
+  assert.match(rendered, /req\/docs/);
+  assert.match(rendered, new RegExp(escapeRegExp(runtimePathFacts.templates_path)));
+  assert.match(rendered, /`src\/`, `scripts\/`, `\.github\/workflows\/`/);
+  assert.doesNotMatch(rendered, /%%ARGS%%|%%DOC_PATH%%|%%GUIDELINES_FILES%%|%%TEMPLATE_PATH%%|%%SRC_PATHS%%|%%TEST_PATH%%|%%EXECUTION_PATH%%|%%INSTALLATION_PATH%%|%%CONFIG_PATH%%/);
+});
+
+test("pi.dev-aware prompts inject manifest conformance rules and API mandates when the manifest exists", () => {
+  ensureBundledResourcesAccessible();
+  const projectBase = process.cwd();
+  const config = getDefaultConfig(projectBase);
+  const rendered = renderPrompt("new", "Add pi integration guidance", projectBase, config);
+  assert.match(rendered, /docs\/pi\.dev\/agent-document-manifest\.json/);
+  assert.match(rendered, /authoritative API contract/);
+  assert.match(rendered, /new or modified pi\.dev CLI integrations MUST comply with the APIs it describes\./);
+  assert.match(rendered, /Treat manifest document paths as relative to `docs\/pi\.dev\/`/);
+});
+
+test("pi.dev-aware prompts stay unchanged when the manifest is absent", () => {
+  ensureBundledResourcesAccessible();
+  const projectBase = fs.mkdtempSync(path.join(os.tmpdir(), "pi-usereq-prompts-"));
+  try {
+    const config = getDefaultConfig(projectBase);
+    const rendered = renderPrompt("new", "Add pi integration guidance", projectBase, config);
+    assert.doesNotMatch(rendered, /docs\/pi\.dev\/agent-document-manifest\.json/);
+    assert.doesNotMatch(rendered, /authoritative API contract/);
+    assert.doesNotMatch(rendered, /Treat manifest document paths as relative to `docs\/pi\.dev\/`/);
+  } finally {
+    fs.rmSync(projectBase, { recursive: true, force: true });
+  }
+});

package/tests/release-workflow.test.ts

@@ -0,0 +1,133 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import test from "node:test";
+
+/**
+ * @brief Loads the npm release workflow YAML for structural assertions.
+ * @details Resolves the repository-local workflow path from the current process working directory and returns the UTF-8 document unchanged so tests can assert release-gating and publication directives deterministically. Runtime is O(n) in file size. Side effects are limited to filesystem reads.
+ * @return {string} Raw workflow YAML text.
+ * @satisfies TST-039
+ */
+function readReleaseWorkflow(): string {
+  return fs.readFileSync(
+    path.join(process.cwd(), ".github", "workflows", "release-npm.yml"),
+    "utf8",
+  );
+}
+
+/**
+ * @brief Describes the package manifest fields asserted by npm release tests.
+ * @details Constrains the parsed `package.json` shape to the publication identity and provenance metadata required by the release workflow tests. The interface is compile-time only and introduces no runtime side effects.
+ */
+interface PackageManifest {
+  name?: unknown;
+  repository?: {
+    type?: unknown;
+    url?: unknown;
+  };
+  bugs?: {
+    url?: unknown;
+  };
+  homepage?: unknown;
+}
+
+/**
+ * @brief Loads the repository package manifest for npm publication assertions.
+ * @details Resolves `package.json` from the current process working directory, parses the UTF-8 JSON document, and returns the manifest object so tests can assert publication identity and provenance metadata deterministically. Runtime is O(n) in file size. Side effects are limited to filesystem reads.
+ * @return {PackageManifest} Parsed package manifest.
+ * @satisfies TST-042, TST-044
+ */
+function readPackageManifest(): PackageManifest {
+  return JSON.parse(
+    fs.readFileSync(path.join(process.cwd(), "package.json"), "utf8"),
+  ) as PackageManifest;
+}
+
+/**
+ * @brief Asserts the fixed npm package name used for publication.
+ * @details Loads `package.json` and verifies that the published package name remains `pi-usereq`, preserving the canonical npm package identity. Runtime is O(n) in file size. Side effects are limited to filesystem reads through `readPackageManifest`.
+ * @return {void} No return value.
+ * @satisfies TST-042
+ */
+function assertFixedPackageName(): void {
+  const manifest = readPackageManifest();
+
+  assert.equal(manifest.name, "pi-usereq");
+}
+
+/**
+ * @brief Asserts canonical GitHub provenance metadata in `package.json`.
+ * @details Loads `package.json` and verifies that repository, issues, and homepage URLs remain aligned to the canonical GitHub repository required by npm provenance validation. Runtime is O(n) in file size. Side effects are limited to filesystem reads through `readPackageManifest`.
+ * @return {void} No return value.
+ * @satisfies TST-044
+ */
+function assertCanonicalPackageProvenanceMetadata(): void {
+  const manifest = readPackageManifest();
+
+  assert.deepEqual(manifest.repository, {
+    type: "git",
+    url: "git+https://github.com/Ogekuri/PI-useReq.git",
+  });
+  assert.deepEqual(manifest.bugs, {
+    url: "https://github.com/Ogekuri/PI-useReq/issues",
+  });
+  assert.equal(manifest.homepage, "https://github.com/Ogekuri/PI-useReq#readme");
+}
+
+test(
+  "release workflow keeps the current tag trigger and gates release work on origin/master ancestry",
+  () => {
+    const workflow = readReleaseWorkflow();
+
+    assert.match(workflow, /name:\s+Release \(npm\)/);
+    assert.match(workflow, /tags:\s*\n\s*-\s*'v\[0-9\]\+\.\[0-9\]\+\.\[0-9\]\+'/);
+    assert.ok(workflow.includes("check-branch:"));
+    assert.ok(workflow.includes("is_master: ${{ steps.check.outputs.is_master }}"));
+    assert.ok(workflow.includes("git fetch origin master"));
+    assert.ok(workflow.includes('grep -q "origin/master"'));
+    assert.ok(
+      workflow.includes("if: needs.check-branch.outputs.is_master == 'true'"),
+    );
+    assert.ok(workflow.includes("build-release:"));
+  },
+);
+
+test(
+  "release workflow installs dependencies, publishes to npm, and creates the GitHub release",
+  () => {
+    const workflow = readReleaseWorkflow();
+
+    assert.ok(workflow.includes("uses: actions/setup-node@v4"));
+    assert.ok(workflow.includes("registry-url: 'https://registry.npmjs.org'"));
+    assert.ok(workflow.includes("run: npm ci"));
+    assert.ok(workflow.includes("run: npm pkg delete private"));
+    assert.ok(
+      workflow.includes("run: npm publish --provenance --access public"),
+    );
+    assert.ok(workflow.includes("NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}"));
+    assert.ok(
+      workflow.includes(
+        "uses: mikepenz/release-changelog-builder-action@v6",
+      ),
+    );
+    assert.ok(workflow.includes("uses: softprops/action-gh-release@v2"));
+    assert.ok(workflow.includes("draft: false"));
+    assert.ok(workflow.includes("prerelease: false"));
+    assert.ok(
+      workflow.includes(
+        "body: ${{ steps.build_changelog.outputs.changelog }}",
+      ),
+    );
+  },
+);
+
+test(
+  "package manifest keeps the npm publication name fixed to pi-usereq",
+  assertFixedPackageName,
+);
+
+test(
+  "package manifest keeps canonical repository, bugs, and homepage metadata for npm provenance",
+  assertCanonicalPackageProvenanceMetadata,
+);