start-command 0.38.0 → 0.39.0

package/src/lib/status-probe.js

@@ -0,0 +1,149 @@
+/**
+ * Live docker state of a detached execution, for `--status` and `--list`.
+ *
+ * Split out of `status-formatter` (as `status_probe.rs` is in Rust) so the
+ * probing stays separate from the rendering and both files stay under the
+ * repository line budget (issue #243).
+ */
+
+const { getDockerCommand, getDockerSpawnOptions } = require('./docker-cleanup');
+const { normalizeDockerTimestamp } = require('./docker-post-mortem');
+const {
+  CONTAINER_STATE_REMOVED,
+  dockerInspect,
+} = require('./container-removal');
+
+/**
+ * Inspect the live state of a detached docker container by name.
+ *
+ * Distinguishes three outcomes that matter for status reporting:
+ * - the container exists and is running,
+ * - the container exists but has stopped (with a real exit code), and
+ * - the container cannot be inspected at all.
+ *
+ * The last case is crucial on slow Docker-in-Docker hosts (issue #136): right
+ * after `docker run -d` returns, `docker inspect <name>` can transiently fail
+ * because the container is not visible yet. A failed inspect must NOT be read
+ * as "stopped"; it means "unknown", so callers can keep the session running
+ * instead of fabricating a terminal `-1` result.
+ *
+ * @param {string} sessionName - Container name
+ * @param {Object|null} [probe] - Receives `sessionNotFound` (issue #225)
+ * @returns {{running: boolean, exitCode: number|null, oomKilled: boolean|null}|null} State,
+ *   or null when the container cannot be inspected (not found yet, removed, or docker error)
+ */
+function inspectDockerState(sessionName, probe = null) {
+  const { stdout, notFound } = dockerInspect(
+    getDockerCommand(),
+    dockerProbeSpawnOptions(),
+    '{{.State.Running}} {{.State.ExitCode}} {{.State.OOMKilled}} ' +
+      '{{.State.StartedAt}} {{.State.FinishedAt}}',
+    sessionName
+  );
+  if (probe) {
+    // "No such container" is a fact, unlike a docker that cannot be reached
+    // (issue #225); it still reads as unknown liveness here (issue #136).
+    probe.sessionNotFound = notFound;
+  }
+  if (stdout === null) {
+    return null;
+  }
+  // Parsed positionally and defensively: an older docker (or a stubbed one)
+  // may answer with fewer fields than the template asks for.
+  const [runningRaw, exitRaw, oomKilledRaw, startedRaw, finishedRaw] = stdout
+    .trim()
+    .split(/\s+/);
+  const exitCode = Number.parseInt(exitRaw, 10);
+  return {
+    running: runningRaw === 'true',
+    exitCode: Number.isFinite(exitCode) ? exitCode : null,
+    oomKilled:
+      oomKilledRaw === 'true' ? true : oomKilledRaw === 'false' ? false : null,
+    startedAt: normalizeDockerTimestamp(startedRaw),
+    finishedAt: normalizeDockerTimestamp(finishedRaw),
+  };
+}
+
+function isDetachedDockerRecord(record) {
+  const opts = record.options || {};
+  return (
+    opts.isolated === 'docker' &&
+    opts.isolationMode === 'detached' &&
+    Boolean(opts.sessionName)
+  );
+}
+
+function dockerProbeSpawnOptions() {
+  return getDockerSpawnOptions({
+    encoding: 'utf8',
+    env: process.env,
+    stdio: ['pipe', 'pipe', 'pipe'],
+  });
+}
+
+function readDockerState(record, probe = null) {
+  const opts = record.options || {};
+  if (opts.isolated !== 'docker' || !opts.sessionName) {
+    return null;
+  }
+  if (record.containerState === CONTAINER_STATE_REMOVED) {
+    // A removed container stays removed: a relaunch clears the marker, so
+    // there is nothing left to ask Docker (issue #243).
+    return null;
+  }
+  const state = inspectDockerState(opts.sessionName, probe);
+  if (
+    record.attempt &&
+    state?.startedAt &&
+    Date.parse(state.startedAt) < Date.parse(record.attempt.startedAt)
+  ) {
+    return null;
+  }
+  return state;
+}
+
+/**
+ * Best-effort terminal exit code reported by the isolation backend itself
+ * (currently docker via `docker inspect .State.ExitCode`). Returns null when
+ * the backend cannot provide a real code, so callers never surface the `-1`
+ * sentinel for a session whose real exit code is simply not available yet.
+ * A running container has no terminal exit code (docker reports `0` for it),
+ * so only a stopped container contributes one.
+ * @param {{running: boolean, exitCode: number|null}|null} dockerState - Inspected state
+ * @returns {number|null}
+ */
+function backendExitCode(dockerState) {
+  return dockerState && !dockerState.running ? dockerState.exitCode : null;
+}
+
+/**
+ * Reconcile the OOM observation from the stored record and from `docker inspect`.
+ *
+ * `State.OOMKilled` is a container-cgroup flag: the kernel sets it when ANY
+ * process in the cgroup is OOM-killed and it is never cleared for the life of
+ * the container (moby/moby#47618). It is therefore an *observation*, never a
+ * verdict about the session (issue #151) — a container that lost one child
+ * process keeps running and can still exit `0`. Once observed, the flag stays
+ * `true` for the record.
+ * @param {Object} record - Execution record
+ * @param {{oomKilled: boolean|null}|null} dockerState - Inspected state
+ * @returns {boolean|undefined} Observation, or undefined when nothing is known
+ */
+function resolveOomObservation(record, dockerState) {
+  if (record.oomKilled === true || dockerState?.oomKilled === true) {
+    return true;
+  }
+  if (record.oomKilled === false || dockerState?.oomKilled === false) {
+    return false;
+  }
+  return undefined;
+}
+
+module.exports = {
+  backendExitCode,
+  dockerProbeSpawnOptions,
+  inspectDockerState,
+  isDetachedDockerRecord,
+  readDockerState,
+  resolveOomObservation,
+};

package/src/lib/store-decode-cache.js

@@ -0,0 +1,141 @@
+/**
+ * Decoded execution store, shared within one process and between processes
+ * (issue #243).
+ *
+ * Decoding `executions.lino` costs about 1-4 ms per record, and one
+ * `--status` used to decode it up to three times (`get`, then `getAll` twice
+ * for the execution chain). The file is still read on every call, so a write
+ * by any process is seen at once, but it is decoded again only when its
+ * content differs from the last decoded copy. The content itself is the key:
+ * unlike an mtime, it cannot miss two same-size writes within one clock tick.
+ *
+ * A new process (every `$ --status` poll) still had to decode once. The
+ * decoded records are therefore also kept as JSON next to the store, tagged
+ * with the SHA-256 of the content they were decoded from; `JSON.parse` of
+ * that copy is about 250 times faster than the lino decode. A copy whose
+ * digest does not match the current content is ignored and replaced.
+ */
+
+const fs = require('fs');
+const crypto = require('crypto');
+const { isDeepStrictEqual } = require('util');
+const { atomicWrite } = require('./atomic-write');
+
+/** Format tag of the JSON copy; a different tag is ignored. */
+const DECODED_COPY_FORMAT = 'start-command-decoded-store-js-1';
+
+/** @type {Map<string, {content: string, data: *, decodes: number}>} */
+const decodedStores = new Map();
+
+function digestOf(content) {
+  return crypto.createHash('sha256').update(content).digest('hex');
+}
+
+/**
+ * Records of the JSON copy at `copyPath`, when it was decoded from content
+ * with this digest; otherwise undefined.
+ */
+function readDecodedCopy(copyPath, digest) {
+  try {
+    const copy = JSON.parse(fs.readFileSync(copyPath, 'utf8'));
+    if (copy && copy.format === DECODED_COPY_FORMAT && copy.sha256 === digest) {
+      return copy.records;
+    }
+  } catch {
+    /* Missing or unreadable: decode instead. */
+  }
+  return undefined;
+}
+
+/**
+ * Keep `data` as JSON for the next process, unless JSON cannot represent it
+ * exactly. Best effort: a read-only folder only costs the next decode.
+ */
+function writeDecodedCopy(copyPath, digest, data) {
+  try {
+    const json = JSON.stringify({
+      format: DECODED_COPY_FORMAT,
+      sha256: digest,
+      records: data,
+    });
+    if (!isDeepStrictEqual(JSON.parse(json).records, data)) {
+      return;
+    }
+    atomicWrite(copyPath, json);
+  } catch {
+    /* Not kept; the next process decodes again. */
+  }
+}
+
+/**
+ * Decode `content` of the store at `filePath`, or reuse an earlier decode of
+ * the same content. Every call returns its own deep copy, so callers may
+ * mutate the records they get.
+ * @param {string} filePath - Store file the content was read from
+ * @param {string} content - Current file content
+ * @param {function(string): *} decode - Decoder for a changed content
+ * @param {{copyPath?: string}} [options] - JSON copy shared between processes
+ * @returns {{data: *, reused: boolean, source: 'memory'|'copy'|'decode'}}
+ */
+function decodeStoreContent(filePath, content, decode, options = {}) {
+  const cached = decodedStores.get(filePath);
+  if (cached && cached.content === content) {
+    return {
+      data: structuredClone(cached.data),
+      reused: true,
+      source: 'memory',
+    };
+  }
+  const decodes = cached ? cached.decodes : 0;
+  const { copyPath } = options;
+  const digest = copyPath ? digestOf(content) : null;
+  const copied = copyPath ? readDecodedCopy(copyPath, digest) : undefined;
+  if (copied !== undefined) {
+    decodedStores.set(filePath, {
+      content,
+      data: structuredClone(copied),
+      decodes,
+    });
+    return { data: copied, reused: true, source: 'copy' };
+  }
+  const data = decode(content);
+  decodedStores.set(filePath, {
+    content,
+    data: structuredClone(data),
+    decodes: decodes + 1,
+  });
+  if (copyPath) {
+    writeDecodedCopy(copyPath, digest, data);
+  }
+  return { data, reused: false, source: 'decode' };
+}
+
+/**
+ * How many times this process decoded the store at `filePath` since it was
+ * last forgotten.
+ * @param {string} filePath - Store file
+ * @returns {number}
+ */
+function decodeCount(filePath) {
+  const cached = decodedStores.get(filePath);
+  return cached ? cached.decodes : 0;
+}
+
+/**
+ * Drop the decoded copy of a store held by this process.
+ * @param {string} [filePath] - Store file; all stores when omitted
+ */
+function forgetDecodedStore(filePath) {
+  if (filePath === undefined) {
+    decodedStores.clear();
+  } else {
+    decodedStores.delete(filePath);
+  }
+}
+
+module.exports = {
+  DECODED_COPY_FORMAT,
+  decodeCount,
+  decodeStoreContent,
+  forgetDecodedStore,
+};

package/src/lib/usage.js

@@ -18,12 +18,14 @@ Options:
   --env, -e <KEY=VALUE> Environment variable for docker container (repeatable, docker only)
   --label <KEY=VALUE>   Container attribution (repeatable, docker only; start-command.* reserved)
   --privileged          Run docker container in privileged mode (docker only)
+  --init, --no-init     Run tini as PID 1 to reap orphaned processes (docker only; default START_COMMAND_DOCKER_INIT=1)
   --network <name>      Connect to a named network (repeatable, docker only)
   --network-alias <alias> Add alias to the first network (repeatable, docker only)
   --on-kill-resume <N>  Resume a killed (exit 137 / OOM) detached docker session up to N times
   --recovery-command <cmd>  Command to run in the same container on such a resume
   --on-kill-resume-delay <min[-max]>  Wait a random number of seconds before each such resume (default 0)
   --memory <size|N%|MIN%-MAX%>  Docker RAM cap; percentages use daemon capacity
+  --memory-reservation <spec>  Soft memory limit (Docker size or N%, below --memory)
   --memory-swap <spec>  Combined memory+swap cap (defaults to memory, no extra swap)
   --cpus <n|N%|MIN%-MAX%>  Docker CPU cap; ranges draw once per creation
   --on-kill-resume-memory <spec>  New memory cap before a qualifying OOM recovery
@@ -79,6 +81,7 @@ Examples:
   $ --isolated docker --image ghcr.io/link-foundation/box-js:latest -- bun --version
   $ -i docker -v ~/.config/gh:/root/.config/gh -e TOKEN=abc -- gh repo list
   $ -i docker --image konard/hive-mind-dind:latest --privileged -- solve ...
+  $ -i docker --init -d -- solve ...       # tini reaps zombies of long-running tasks
   $ --isolated ssh --endpoint user@remote.server -- ls -la
   $ --isolated-user -- npm test            # Create isolated user
   $ -u myuser -- npm start                 # Custom username

package/test/cargo-lock-version.mjs

@@ -0,0 +1,121 @@
+import { describe, expect, it } from 'bun:test';
+import { mkdtempSync, readFileSync, writeFileSync } from 'fs';
+import { tmpdir } from 'os';
+import path from 'path';
+import {
+  setCargoLockPackageVersion,
+  syncCargoLockVersion,
+} from '../../scripts/cargo-lock-version.mjs';
+
+const repoRoot = path.resolve(import.meta.dir, '../..');
+const lock = (version, eol = '\n') =>
+  [
+    '# This file is automatically @generated by Cargo.',
+    'version = 4',
+    '',
+    '[[package]]',
+    'name = "start-command"',
+    `version = "${version}"`,
+    'dependencies = [',
+    ' "serde",',
+    ']',
+    '',
+    '[[package]]',
+    'name = "start-command-helper"',
+    'version = "9.9.9"',
+    '',
+  ].join(eol);
+
+describe('setCargoLockPackageVersion', () => {
+  it('rewrites only the named package entry', () => {
+    const result = setCargoLockPackageVersion(
+      lock('0.23.0'),
+      'start-command',
+      '0.27.0'
+    );
+    expect(result).toEqual({
+      text: lock('0.27.0'),
+      found: true,
+      changed: true,
+    });
+    expect(result.text).toContain('version = "9.9.9"');
+  });
+
+  it('reports an already synced entry as unchanged', () => {
+    expect(
+      setCargoLockPackageVersion(lock('0.27.0'), 'start-command', '0.27.0')
+    ).toEqual({ text: lock('0.27.0'), found: true, changed: false });
+  });
+
+  it('keeps CRLF line endings', () => {
+    expect(
+      setCargoLockPackageVersion(
+        lock('0.1.0', '\r\n'),
+        'start-command',
+        '0.2.0'
+      ).text
+    ).toBe(lock('0.2.0', '\r\n'));
+  });
+
+  it('does not match a package whose name only starts with the crate name', () => {
+    expect(
+      setCargoLockPackageVersion(lock('0.1.0'), 'start', '1.0.0').found
+    ).toBe(false);
+  });
+});
+
+describe('syncCargoLockVersion', () => {
+  it('writes the file only when the version changes', () => {
+    const file = path.join(mkdtempSync(path.join(tmpdir(), 'lock-')), 'l');
+    writeFileSync(file, lock('0.1.0'));
+    expect(syncCargoLockVersion(file, 'start-command', '0.2.0')).toBe(true);
+    expect(readFileSync(file, 'utf8')).toBe(lock('0.2.0'));
+    expect(syncCargoLockVersion(file, 'start-command', '0.2.0')).toBe(false);
+  });
+
+  it('skips a missing lock file and rejects a lock without the crate', () => {
+    const dir = mkdtempSync(path.join(tmpdir(), 'lock-'));
+    expect(
+      syncCargoLockVersion(path.join(dir, 'none'), 'start-command', '1.0.0')
+    ).toBe(false);
+    const file = path.join(dir, 'Cargo.lock');
+    writeFileSync(file, lock('0.1.0'));
+    expect(() => syncCargoLockVersion(file, 'other', '1.0.0')).toThrow(
+      /no \[\[package\]\] entry for other/
+    );
+  });
+});
+
+describe('repository Cargo.lock (issue #234)', () => {
+  it('records the Cargo.toml version of the crate', () => {
+    const manifest = readFileSync(
+      path.join(repoRoot, 'rust/Cargo.toml'),
+      'utf8'
+    );
+    const name = manifest.match(/^name\s*=\s*"([^"]+)"/m)[1];
+    const version = manifest.match(/^version\s*=\s*"([^"]+)"/m)[1];
+    const result = setCargoLockPackageVersion(
+      readFileSync(path.join(repoRoot, 'rust/Cargo.lock'), 'utf8'),
+      name,
+      version
+    );
+    expect(result.found).toBe(true);
+    expect(result.changed).toBe(false);
+  });
+
+  it('is synced and staged by both Rust version bump scripts', () => {
+    for (const script of ['version-and-commit.mjs', 'bump-version.mjs']) {
+      const source = readFileSync(
+        path.join(repoRoot, 'scripts', script),
+        'utf8'
+      );
+      expect(source).toContain("syncCargoLockVersion('Cargo.lock'");
+    }
+    expect(
+      readFileSync(
+        path.join(repoRoot, 'scripts/version-and-commit.mjs'),
+        'utf8'
+      )
+    ).toContain("['Cargo.toml', 'Cargo.lock', 'CHANGELOG.md', 'changelog.d']");
+  });
+});

package/test/check-rust-coverage.mjs

@@ -0,0 +1,71 @@
+import { describe, expect, it } from 'bun:test';
+
+import {
+  checkCoverage,
+  parseTarpaulinCoverage,
+} from '../../scripts/check-rust-coverage.mjs';
+
+// Tail of a passing cargo-tarpaulin 0.37.5 run (Rust CI/CD, run 39256972823).
+const PASSING_LOG = `|| src/lib/usage.rs: 0/1
+|| src/lib/user_manager.rs: 48/170
+||
+73.81% coverage, 6296/8530 lines covered
+`;
+
+// Tail of the failing run on main (run 39257928573): a test failed, tarpaulin
+// stopped before its summary, and the old step reported
+// "Coverage % is below the 50% threshold" (issue #234).
+const FAILED_TEST_LOG = `failures:
+    reservation_failure_after_cleanup_preserves_restart_state
+
+test result: FAILED. 5 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.13s
+
+Error: "Test failed during run"
+`;
+
+describe('check-rust-coverage', () => {
+  it('parses the tarpaulin summary line', () => {
+    expect(parseTarpaulinCoverage(PASSING_LOG)).toBe(73.81);
+  });
+
+  it('uses the last summary when several are printed', () => {
+    const log =
+      '10.00% coverage, 1/10 lines covered\r\n60.5% coverage, 6/10 lines covered\r\n';
+    expect(parseTarpaulinCoverage(log)).toBe(60.5);
+  });
+
+  it('ignores lines that only mention coverage', () => {
+    expect(parseTarpaulinCoverage('Coverage: 73.81%\n')).toBeNull();
+    expect(parseTarpaulinCoverage('')).toBeNull();
+    expect(parseTarpaulinCoverage(undefined)).toBeNull();
+  });
+
+  it('passes when coverage meets the threshold', () => {
+    const result = checkCoverage(PASSING_LOG, 50);
+    expect(result.ok).toBe(true);
+    expect(result.message).toBe('✅ Coverage 73.81% meets the 50% threshold');
+  });
+
+  it('fails when coverage is below the threshold', () => {
+    const result = checkCoverage(PASSING_LOG, 80);
+    expect(result.ok).toBe(false);
+    expect(result.message).toBe(
+      '❌ Coverage 73.81% is below the 80% threshold'
+    );
+  });
+
+  it('reports a failed test instead of an empty coverage drop (issue #234)', () => {
+    const result = checkCoverage(FAILED_TEST_LOG, 50);
+    expect(result.ok).toBe(false);
+    expect(result.coverage).toBeNull();
+    expect(result.message).toContain('a test failed');
+    expect(result.message).not.toContain('below the');
+    expect(result.message).not.toContain('Coverage %');
+  });
+
+  it('fails when the log has no summary for another reason', () => {
+    const result = checkCoverage('error: could not compile', 50);
+    expect(result.ok).toBe(false);
+    expect(result.message).toContain('Could not determine coverage');
+  });
+});

package/test/check-web-archive.mjs

@@ -0,0 +1,154 @@
+// Regression tests for the lychee report parser used by the Broken Link
+// Checker workflow. A lychee error without an http(s) URL - a missing local
+// file, an unresolvable root-relative link - has no Wayback equivalent. Such
+// errors must still be reported, and must keep the check red.
+import assert from 'node:assert/strict';
+import { describe, it } from 'bun:test';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { spawnSync } from 'node:child_process';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  extractBrokenLinks,
+  extractBrokenUrls,
+  extractErrorsSection,
+} from '../../scripts/check-web-archive.mjs';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const report = readFileSync(
+  join(here, 'fixtures', 'lychee-report.md'),
+  'utf-8'
+);
+
+describe('extractErrorsSection', () => {
+  it('stops at the next top-level heading', () => {
+    const section = extractErrorsSection(report);
+    assert.ok(section.includes('Errors in README.md'));
+    assert.ok(
+      !section.includes('Redirects per input'),
+      'the redirects section must not leak into the errors section'
+    );
+  });
+
+  it('falls back to the whole document when the heading is absent', () => {
+    const legacy = '# Link report\n\n* [404] https://broken.example/legacy\n';
+    assert.equal(extractErrorsSection(legacy), legacy);
+  });
+});
+
+describe('extractBrokenUrls', () => {
+  it('ignores successful redirects outside the errors section', () => {
+    const shortReport = `## Errors per input
+
+### Errors in docs/reference.md
+
+* [502] <https://broken.example/reference> (at 1:1) | Rejected status code: 502
+
+## Redirects per input
+
+### Redirects in README.md
+
+* https://working.example/old --[301]--> https://working.example/current
+`;
+
+    assert.deepEqual(extractBrokenUrls(shortReport), [
+      'https://broken.example/reference',
+    ]);
+  });
+
+  it('parses the full document when the errors section is absent', () => {
+    const legacyReport = `# Link report
+
+* [404] https://broken.example/legacy
+`;
+
+    assert.deepEqual(extractBrokenUrls(legacyReport), [
+      'https://broken.example/legacy',
+    ]);
+  });
+
+  it('extracts every http error from a full report exactly once', () => {
+    assert.deepEqual(extractBrokenUrls(report), [
+      'https://example.com/csharp/',
+      'https://example.com/rust/link_cli/',
+    ]);
+  });
+});
+
+describe('extractBrokenLinks', () => {
+  it('reports errors that the Wayback Machine cannot answer', () => {
+    const { others } = extractBrokenLinks(report);
+    assert.equal(
+      others.length,
+      2,
+      'the missing DocFX file and the unresolvable root-relative link must not be silently dropped'
+    );
+    assert.ok(
+      others.some((link) => link.endsWith('Foundation.Data.Doublets.Cli.yml')),
+      'the missing local file must be reported'
+    );
+    assert.ok(
+      others.includes('error:'),
+      'the unresolvable root-relative link must be reported'
+    );
+  });
+
+  it('never classifies a non-http error as a URL', () => {
+    const localOnly = `## Errors per input
+
+### Errors in docs/index.md
+
+* [ERROR] <file:///repo/docs/api/Some.Type.yml> (at 15:12) | File not found. Check if file exists and path is correct
+`;
+
+    const { urls, others } = extractBrokenLinks(localOnly);
+    assert.deepEqual(urls, []);
+    assert.deepEqual(others, ['file:///repo/docs/api/Some.Type.yml']);
+  });
+
+  it('matches the error count lychee itself reports', () => {
+    const { urls, others } = extractBrokenLinks(report);
+    const reported = Number(/🚫 Errors\s*\|\s*(\d+)/.exec(report)[1]);
+    assert.equal(urls.length + others.length, reported);
+  });
+});
+
+describe('check-web-archive.mjs end to end', () => {
+  it('fails when the only lychee errors have no http URL to archive', async () => {
+    const scriptPath = join(
+      here,
+      '..',
+      '..',
+      'scripts',
+      'check-web-archive.mjs'
+    );
+    const workDir = mkdtempSync(join(tmpdir(), 'web-archive-'));
+    const reportPath = join(workDir, 'out.md');
+    const outputPath = join(workDir, 'github-output.txt');
+    writeFileSync(
+      reportPath,
+      `## Errors per input
+
+### Errors in docs/index.md
+
+* [ERROR] <file:///repo/docs/api/Some.Type.yml> (at 15:12) | File not found. Check if file exists and path is correct
+`
+    );
+    writeFileSync(outputPath, '');
+
+    const result = spawnSync(process.execPath, [scriptPath], {
+      encoding: 'utf-8',
+      env: {
+        ...process.env,
+        LYCHEE_OUTPUT: reportPath,
+        GITHUB_OUTPUT: outputPath,
+      },
+    });
+
+    assert.equal(result.status, 1, result.stdout + result.stderr);
+    assert.match(readFileSync(outputPath, 'utf-8'), /all_archived=false/);
+    rmSync(workDir, { recursive: true, force: true });
+  });
+});