start-command 0.37.9 → 0.39.0

package/test/docker-runtime-options.js

@@ -303,6 +303,7 @@ describe('buildDockerRuntimeMetadata', () => {
       labels: null,
       commandHandoff: null,
       privileged: null,
+      init: null,
       network: null,
       networks: null,
       networkAliases: null,
@@ -332,6 +333,7 @@ describe('buildDockerRuntimeMetadata', () => {
         mounts: ['type=bind,src=/h,dst=/c'],
         env: ['FOO=bar'],
         privileged: true,
+        init: null,
         network: 'hive-formal-ai',
         networks: ['hive-formal-ai', 'public-egress'],
         networkAliases: ['formal-ai', 'checker'],

package/test/docker-snapshot-safety.js

@@ -1,3 +1,5 @@
+// Own snapshot lock even without the bunfig.toml preload (issue #234).
+require('./setup/private-snapshot-lock');
 const { test } = require('node:test');
 const assert = require('node:assert/strict');
 const fs = require('node:fs');
@@ -104,3 +106,40 @@ test('snapshot lock is separate from store locks and excludes concurrent process
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });
+
+test('tests never share the host-wide snapshot lock (issue #234)', () => {
+  // bunfig.toml preloads test/setup/private-snapshot-lock.js. Without it a
+  // real `start --resume` holding the default lock failed every resume test.
+  const lockPath = process.env.START_SNAPSHOT_LOCK;
+  assert.ok(lockPath, 'START_SNAPSHOT_LOCK is not set by the test preload');
+  assert.notEqual(
+    lockPath,
+    path.join(
+      process.platform === 'win32' ? os.tmpdir() : '/tmp',
+      'start-command-docker-snapshot.lock'
+    )
+  );
+  const lock = acquireSnapshotLock({ holder: 'issue-234' });
+  try {
+    assert.ok(fs.existsSync(lockPath));
+  } finally {
+    lock.release();
+  }
+});
+
+test('every snapshot test requires its private lock itself (issue #234)', () => {
+  // `bun test ./js/test/x.js` from the repository root skips js/bunfig.toml,
+  // so the preload alone left 18 tests on the host-wide lock.
+  const dir = __dirname;
+  const offenders = fs
+    .readdirSync(dir)
+    .filter((name) => name.endsWith('.js'))
+    .filter((name) => {
+      const source = fs.readFileSync(path.join(dir, name), 'utf8');
+      return (
+        /\b(resumeExecution|acquireSnapshotLock)\(/.test(source) &&
+        !source.includes("require('./setup/private-snapshot-lock')")
+      );
+    });
+  assert.deepEqual(offenders, []);
+});

package/test/execution-resume.js

@@ -2,6 +2,8 @@
  * Tests for --resume and --resume-all (issue #162)
  */
 
+// Own snapshot lock even without the bunfig.toml preload (issue #234).
+require('./setup/private-snapshot-lock');
 const { test, describe } = require('node:test');
 const assert = require('node:assert');
 const {

package/test/fixtures/fake-npm.sh

@@ -0,0 +1,64 @@
+#!/bin/sh
+# Fake `npm` for js/test/npm-publish.mjs (issue #234). State lives in
+# $FAKE_NPM_STATE: `published` marks the version as on the registry,
+# `mode` picks how `npm run changeset:publish` behaves, `calls` logs argv.
+# `pending` holds how many more `npm view` calls miss a version that has
+# landed but not yet propagated to the registry's read path.
+# Any other command goes to $REAL_NPM when set (use-m runs `npm root -g`).
+state="${FAKE_NPM_STATE:?}"
+echo "$*" >> "$state/calls"
+case "$1" in
+  view)
+    if [ -f "$state/outage" ]; then
+      echo "npm error code ECONNRESET" >&2
+      exit 1
+    fi
+    if [ -f "$state/pending" ]; then
+      left="$(cat "$state/pending")"
+      if [ "$left" -le 1 ]; then
+        rm "$state/pending"
+        echo "$FAKE_NPM_VERSION" > "$state/published"
+      else
+        echo $((left - 1)) > "$state/pending"
+      fi
+      echo "npm error code E404" >&2
+      exit 1
+    fi
+    if [ -f "$state/published" ]; then
+      cat "$state/published"
+      exit 0
+    fi
+    echo "npm error code E404" >&2
+    exit 1
+    ;;
+  run)
+    mode="$(cat "$state/mode" 2>/dev/null || echo succeed)"
+    case "$mode" in
+      succeed) echo "$FAKE_NPM_VERSION" > "$state/published"; exit 0 ;;
+      fail) echo "npm error code E403" >&2; exit 1 ;;
+      exit-0-without-publishing) exit 0 ;;
+      fail-after-landing) echo "$FAKE_NPM_VERSION" > "$state/published"; exit 1 ;;
+      land-late) echo 20 > "$state/pending"; exit 0 ;;
+      time-out-while-landing)
+        if [ -f "$state/pending" ] || [ -f "$state/published" ]; then
+          echo "npm error code E403" >&2
+          echo "npm error You cannot publish over the previously published versions: $FAKE_NPM_VERSION." >&2
+          exit 1
+        fi
+        echo 20 > "$state/pending"
+        echo "npm error code ETIMEDOUT" >&2
+        exit 1
+        ;;
+      fail-once)
+        echo succeed > "$state/mode"
+        echo "npm error code E503" >&2
+        exit 1
+        ;;
+    esac
+    ;;
+esac
+if [ -n "${REAL_NPM:-}" ]; then
+  exec "$REAL_NPM" "$@"
+fi
+echo "fake npm: unexpected arguments: $*" >&2
+exit 2

package/test/fixtures/lychee-report.md

@@ -0,0 +1,39 @@
+# Link Checker Report
+
+| Status         | Count |
+| -------------- | ----- |
+| 🔍 Total       | 120   |
+| ✅ Successful  | 108   |
+| ⏳ Timeouts    | 0     |
+| 🔀 Redirected  | 6     |
+| 👻 Excluded    | 2     |
+| ❓ Unknown     | 0     |
+| 🚫 Errors      | 4     |
+| ⛔ Unsupported | 0     |
+
+## Errors per input
+
+### Errors in csharp/docs/index.md
+
+- [ERROR] <file:///home/runner/work/repo/repo/csharp/docs/api/Foundation.Data.Doublets.Cli.yml> (at 15:12) | File not found. Check if file exists and path is correct
+
+### Errors in js/index.html
+
+- [ERROR] <error:> (at 10:49) | Cannot resolve root-relative link '/favicon.svg': To resolve root-relative links in local files, provide a root dir
+
+### Errors in README.md
+
+- [404] <https://example.com/csharp/> (at 48:130) | Rejected status code: 404 Not Found
+- [404] <https://example.com/rust/link_cli/> (at 49:62) | Rejected status code: 404 Not Found
+
+## Redirects per input
+
+### Redirects in README.md
+
+- https://example.com/docs --[302]--> https://example.com/docs/latest/
+- https://example.com/protocols --[301]--> https://example.com/links-notation
+- https://example.com/articles/804617 --[301]--> https://example.com/articles/804617/ --[302]--> https://example.com/companies/articles/804617/
+
+### Redirects in rust/README.md
+
+- https://example.com/docs --[302]--> https://example.com/docs/latest/

package/test/javascript-first-ci.js

@@ -9,6 +9,7 @@ const {
 } = require('../../scripts/check-javascript-first.mjs');
 const {
   checkFeatureChanges,
+  checkRegressionPairs,
 } = require('../../scripts/check-feature-parity.mjs');
 
 const root = resolve(__dirname, '../..');
@@ -178,6 +179,44 @@ describe('JavaScript first CI gate', () => {
     assert.equal(check.status, 0);
   });
 
+  const releaseCheck = (isMain, release, test = 'success') =>
+    spawnSync(
+      process.execPath,
+      [
+        resolve(root, 'scripts/check-stage-status.mjs'),
+        '--required',
+        'test',
+        '--release',
+        'release:test',
+      ],
+      {
+        encoding: 'utf8',
+        env: {
+          ...process.env,
+          IS_MAIN: String(isMain),
+          NEEDS_JSON: JSON.stringify({
+            test: { result: test },
+            release: { result: release },
+          }),
+        },
+      }
+    );
+
+  it('fails a main push whose release was skipped after its needs passed', () => {
+    // Every main release was silently skipped since #234 (issue #240).
+    const check = releaseCheck(true, 'skipped');
+    assert.equal(check.status, 1);
+    assert.match(check.stderr, /release was skipped on a main push/);
+    // The terms of the release condition are printed for the next skip.
+    assert.match(check.stdout, /needs\.test\.result=success/);
+    assert.match(check.stdout, /release: skipped; expected to run: true/);
+  });
+
+  it('accepts a skipped release outside main pushes and a run release on main', () => {
+    assert.equal(releaseCheck(false, 'skipped').status, 0);
+    assert.equal(releaseCheck(true, 'success').status, 0);
+  });
+
   it('rejects a change to only one implementation of a feature', () => {
     const features = [
       {
@@ -194,6 +233,36 @@ describe('JavaScript first CI gate', () => {
     );
   });
 
+  it('keeps both halves of a regression test under one feature', () => {
+    const feature = (id, js, rust) => ({
+      id,
+      javascript: { implementation: [], tests: js },
+      rust: { implementation: [], tests: rust },
+    });
+    assert.equal(
+      checkRegressionPairs([
+        feature('a', ['js/test/regression-193.js'], []),
+        feature('b', [], ['rust/tests/regression_193.rs']),
+      ]).length,
+      1
+    );
+    assert.deepEqual(
+      checkRegressionPairs([
+        feature(
+          'a',
+          ['js/test/regression-201.js'],
+          ['rust/tests/regression_201.rs']
+        ),
+        feature('b', [], ['rust/tests/regression_201.rs']),
+      ]),
+      []
+    );
+    const manifest = JSON.parse(
+      readFileSync(resolve(root, 'parity/features.json'), 'utf8')
+    );
+    assert.deepEqual(checkRegressionPairs(manifest.features), []);
+  });
+
   it('makes Rust callable only after the complete JavaScript stage', () => {
     const files = workflows();
     assert.deepEqual(Object.keys(files['rust.yml'].on), ['workflow_call']);

package/test/links-workflow.mjs

@@ -0,0 +1,127 @@
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'bun:test';
+
+const root = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '../..'
+);
+const workflow = readFileSync(
+  path.join(root, '.github/workflows/links.yml'),
+  'utf8'
+).replaceAll('\r\n', '\n');
+
+function getStepBlock(stepName) {
+  const lines = workflow.split('\n');
+  const header = `      - name: ${stepName}`;
+  const start = lines.findIndex((line) => line === header);
+
+  if (start === -1) {
+    return '';
+  }
+
+  const end = lines.findIndex(
+    (line, index) => index > start && line.startsWith('      - ')
+  );
+
+  return lines.slice(start, end === -1 ? lines.length : end).join('\n');
+}
+
+describe('broken link workflow', () => {
+  it('fails for every nonzero Lychee exit even when an archive exists', () => {
+    const failureStep = getStepBlock('Fail if broken links were found');
+
+    expect(failureStep).toContain('!cancelled()');
+    expect(failureStep).toContain('steps.lychee.outputs.exit_code != 0');
+    expect(failureStep).not.toContain('steps.webarchive.outputs.all_archived');
+    expect(failureStep).toContain(
+      'An archive is a suggested replacement; it does not make the live link valid.'
+    );
+  });
+
+  it('re-asks the links that never got an answer before giving up', () => {
+    const recheckStep = getStepBlock('Re-check transient link failures');
+
+    expect(recheckStep).toContain('id: recheck');
+    expect(recheckStep).toContain('node scripts/recheck-broken-links.mjs');
+    expect(recheckStep).toContain('if: steps.lychee.outputs.exit_code != 0');
+    expect(recheckStep).toContain('LYCHEE_OUTPUT: lychee/out.md');
+    expect(recheckStep).toContain('RECOVERED_OUTPUT: lychee/recovered.txt');
+    expect(recheckStep).toContain('GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}');
+  });
+
+  // `== 'false'` would read a skipped or crashed re-check as "nothing was
+  // recovered" and skip the failure step on an empty output. Only the
+  // negated form fails safe.
+  it('downgrades a failure only when every unanswered link recovered', () => {
+    const webarchiveStep = getStepBlock(
+      'Check broken links against Web Archive'
+    );
+    const failureStep = getStepBlock('Fail if broken links were found');
+
+    for (const step of [webarchiveStep, failureStep]) {
+      expect(step).toContain("steps.recheck.outputs.all_recovered != 'true'");
+      expect(step).not.toMatch(/all_recovered\s*==\s*'false'/);
+    }
+  });
+
+  it('feeds the recovered list to the Web Archive check', () => {
+    const webarchiveStep = getStepBlock(
+      'Check broken links against Web Archive'
+    );
+
+    expect(webarchiveStep).toContain('RECOVERED_URLS: lychee/recovered.txt');
+  });
+
+  // The checker, the archive fallback, and the re-check run from files the
+  // paths filters must name; otherwise editing them silently skips the link
+  // check on the pull request that changed them.
+  it('triggers on changes to every file the check depends on', () => {
+    const expected = [
+      '.lycheeignore',
+      'scripts/check-web-archive.mjs',
+      'scripts/recheck-broken-links.mjs',
+      'js/test/fixtures/lychee-report.md',
+      'js/test/links-workflow.mjs',
+      'js/test/recheck-broken-links.mjs',
+    ];
+
+    for (const trigger of ['push', 'pull_request']) {
+      const triggerBlock = workflow.match(
+        new RegExp(
+          `^  ${trigger}:\\n(?:    .*\\n)*?    paths:\\n((?:      .*\\n)+)`,
+          'm'
+        )
+      );
+
+      expect(Boolean(triggerBlock)).toBe(true);
+
+      for (const path of expected) {
+        expect(triggerBlock[1]).toContain(`- '${path}'`);
+      }
+    }
+  });
+
+  // `--cache` writes .lycheecache into the workspace, which a fresh runner
+  // discards; without a cache step `--max-cache-age` never applies (#234).
+  it('persists the lychee cache it asks for', () => {
+    expect(workflow).toContain('--cache');
+    const cacheStep = getStepBlock('Restore lychee cache');
+    expect(cacheStep).toContain('uses: actions/cache@');
+    expect(cacheStep).toContain('path: .lycheecache');
+  });
+
+  // The failure message sends readers to lychee/out.md; it has to exist
+  // outside the runner that wrote it (#234).
+  it('uploads the report the failure message points at', () => {
+    expect(getStepBlock('Fail if broken links were found')).toContain(
+      'lychee-report workflow artifact'
+    );
+    const uploadStep = getStepBlock('Upload lychee report');
+    expect(uploadStep).toContain('uses: actions/upload-artifact@');
+    expect(uploadStep).toContain('name: lychee-report');
+    expect(uploadStep).toContain('path: lychee/');
+    expect(uploadStep).toContain('!cancelled()');
+  });
+});

package/test/lint-gate.mjs

@@ -0,0 +1,56 @@
+// ESLint exits 0 when it finds only warnings, so `eslint .` let every
+// warn-level rule (require-await) through CI unnoticed (issue #234). Each lint
+// command CI and the pre-commit hook run must reject a warning-only file.
+import { describe, expect, it } from 'bun:test';
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const jsRoot = join(import.meta.dir, '..');
+const eslint = join(jsRoot, 'node_modules', '.bin', 'eslint');
+const pkg = JSON.parse(readFileSync(join(jsRoot, 'package.json'), 'utf8'));
+
+// Prettier-clean, so the only finding is the require-await warning.
+const warningOnly = 'export async function f() {\n  return 1;\n}\n';
+
+/** Run an `eslint ...` command on stdin in place of the paths it lints. */
+function lintWarningOnly(command, cwd, filename) {
+  const [bin, ...args] = command.trim().split(/\s+/);
+  expect(bin).toBe('eslint');
+  const flags = args.filter((arg) => arg !== '.');
+  return spawnSync(
+    eslint,
+    [...flags, '--stdin', '--stdin-filename', filename],
+    { cwd, input: warningOnly, encoding: 'utf8' }
+  );
+}
+
+describe('lint gate', () => {
+  it('fails `bun run lint` on a warning', () => {
+    const result = lintWarningOnly(pkg.scripts.lint, jsRoot, 'src/probe.mjs');
+    expect(result.stdout).toContain('require-await');
+    expect(result.status).toBe(1);
+  });
+
+  it('fails `bun run lint:scripts` on a warning', () => {
+    const command = pkg.scripts['lint:scripts'].replace(/^cd \.\. && /, '');
+    const result = lintWarningOnly(
+      command,
+      join(jsRoot, '..'),
+      'scripts/probe.mjs'
+    );
+    expect(result.stdout).toContain('require-await');
+    expect(result.status).toBe(1);
+  });
+
+  it('fails the pre-commit hook on a warning', () => {
+    const [command] = pkg['lint-staged']['*.{js,mjs,cjs}'];
+    const result = lintWarningOnly(
+      command.replace(' --fix', ''),
+      jsRoot,
+      'src/probe.mjs'
+    );
+    expect(result.stdout).toContain('require-await');
+    expect(result.status).toBe(1);
+  });
+});

package/test/npm-publish.mjs

@@ -0,0 +1,181 @@
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import {
+  copyFileSync,
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { $ } from 'command-stream';
+
+import {
+  DEFAULT_VERIFY_ATTEMPTS,
+  isAlreadyPublishedError,
+  isNpmVersionPublished,
+  publishToNpm,
+} from '../../scripts/npm-publish.mjs';
+
+const NAME = 'start-command';
+const VERSION = '9.9.9';
+const noSleep = async () => {};
+
+let dir;
+let $npm;
+
+/**
+ * Run fixtures/fake-npm.sh wherever the script under test runs `npm`. It is
+ * called by absolute path, not found through PATH: command-stream runs
+ * commands in a login shell (`sh -l -c`), and on macOS /etc/profile puts the
+ * system directories, which hold the real npm, before ours (issue #234;
+ * experiments/issue-234/login-shell-path-reorder.sh). The env goes to `$`
+ * explicitly: Bun hands spawned children its startup environment, not
+ * later `process.env` writes.
+ */
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'npm-publish-'));
+  const fakeNpm = join(dir, 'npm');
+  copyFileSync(join(import.meta.dir, 'fixtures', 'fake-npm.sh'), fakeNpm);
+  const $env = $({
+    env: {
+      ...process.env,
+      FAKE_NPM_STATE: dir,
+      FAKE_NPM_VERSION: VERSION,
+    },
+  });
+  $npm = (strings, ...values) =>
+    $env(
+      [strings[0].replace(/^npm(?= )/, `'${fakeNpm}'`), ...strings.slice(1)],
+      ...values
+    );
+});
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+function mode(value) {
+  writeFileSync(join(dir, 'mode'), value);
+}
+
+function publishCalls() {
+  return readFileSync(join(dir, 'calls'), 'utf8')
+    .split('\n')
+    .filter((line) => line.startsWith('run changeset:publish')).length;
+}
+
+const options = { name: NAME, version: VERSION, sleep: noSleep };
+
+describe.skipIf(process.platform === 'win32')('npm-publish', () => {
+  it('fails when every publish attempt exits non-zero (issue #234)', async () => {
+    // command-stream resolves on a non-zero exit; the old try/catch loop
+    // reported "✅ Published" and set published=true here.
+    mode('fail');
+    await expect(publishToNpm($npm, options)).rejects.toThrow(
+      `Failed to publish ${NAME}@${VERSION} after 3 attempts`
+    );
+    expect(publishCalls()).toBe(3);
+  });
+
+  it('fails when publish exits 0 but the registry never shows the version', async () => {
+    mode('exit-0-without-publishing');
+    await expect(
+      publishToNpm($npm, { ...options, verifyAttempts: 2 })
+    ).rejects.toThrow('exited 0 but start-command@9.9.9 is not on npm');
+  });
+
+  it('publishes and confirms the version on the registry', async () => {
+    mode('succeed');
+    expect(await publishToNpm($npm, options)).toEqual({
+      alreadyPublished: false,
+    });
+    expect(existsSync(join(dir, 'published'))).toBe(true);
+  });
+
+  it('retries a failed attempt', async () => {
+    mode('fail-once');
+    expect(await publishToNpm($npm, options)).toEqual({
+      alreadyPublished: false,
+    });
+    expect(publishCalls()).toBe(2);
+  });
+
+  it('accepts an attempt that failed client-side after the version landed', async () => {
+    mode('fail-after-landing');
+    expect(await publishToNpm($npm, options)).toEqual({
+      alreadyPublished: false,
+    });
+    expect(publishCalls()).toBe(1);
+  });
+
+  // npm can take minutes to show a version it accepted; the template has
+  // seen 874s. A 60-second wait failed a release that had published (#234).
+  it('waits as long as npm takes to show a published version', async () => {
+    mode('land-late');
+    expect(await publishToNpm($npm, options)).toEqual({
+      alreadyPublished: false,
+    });
+    expect(publishCalls()).toBe(1);
+  });
+
+  // A retry after a timed-out attempt that landed is rejected with "cannot
+  // publish over the previously published versions". That is a cue to wait
+  // for the registry, not a failure to retry (#234).
+  it('waits instead of republishing when npm says the version exists', async () => {
+    mode('time-out-while-landing');
+    expect(await publishToNpm($npm, options)).toEqual({
+      alreadyPublished: false,
+    });
+    expect(publishCalls()).toBe(2);
+  });
+
+  it('skips publishing a version that is already on npm', async () => {
+    writeFileSync(join(dir, 'published'), `${VERSION}\n`);
+    expect(await publishToNpm($npm, options)).toEqual({
+      alreadyPublished: true,
+    });
+    expect(existsSync(join(dir, 'mode'))).toBe(false);
+  });
+
+  it('treats only E404 as "not published" and fails closed otherwise', async () => {
+    expect(await isNpmVersionPublished($npm, NAME, VERSION)).toBe(false);
+    writeFileSync(join(dir, 'outage'), '');
+    await expect(isNpmVersionPublished($npm, NAME, VERSION)).rejects.toThrow(
+      'ECONNRESET'
+    );
+  });
+
+  it('reads every "npm already has this version" answer as landed', () => {
+    for (const output of [
+      'npm error code E403\nnpm error You cannot publish over the previously published versions: 9.9.9.',
+      'npm error code E409\nnpm error 409 Conflict - PUT https://registry.npmjs.org/start-command - Cannot publish over previously staged version 9.9.9',
+      'npm ERR! code EPUBLISHCONFLICT',
+    ]) {
+      expect(isAlreadyPublishedError(output)).toBe(true);
+    }
+    expect(
+      isAlreadyPublishedError('npm error code E403\nnpm error 403 Forbidden')
+    ).toBe(false);
+  });
+
+  // The registry wait is useless if the job is killed first (#234).
+  it('gives every publishing job time to outlast the registry wait', () => {
+    const workflow = readFileSync(
+      join(import.meta.dir, '..', '..', '.github', 'workflows', 'js.yml'),
+      'utf8'
+    );
+    const jobs = workflow.split(/\n(?= {2}[a-z-]+:\n)/);
+    const publishers = jobs.filter((job) =>
+      job.includes('scripts/publish-to-npm.mjs')
+    );
+    expect(publishers.length).toBe(2);
+    const waitMinutes = (DEFAULT_VERIFY_ATTEMPTS * 10) / 60;
+    for (const job of publishers) {
+      const minutes = Number(/^ {4}timeout-minutes: (\d+)$/m.exec(job)[1]);
+      expect(minutes).toBeGreaterThanOrEqual(waitMinutes + 15);
+    }
+  });
+});