start-command 0.38.0 → 0.39.0

package/test/ci-workflow-invariants.js

@@ -127,6 +127,51 @@ function inRunBlock(workflow, index) {
   return false;
 }
 
+/** The `needs:` of a job, written inline (`[a, b]`) or as a block list. */
+function parseNeeds(body) {
+  const inline = jobKey(body, 'needs');
+  if (inline === null) {
+    return [];
+  }
+  if (inline) {
+    return inline
+      .split(/[,[\]]/)
+      .map((entry) => entry.trim())
+      .filter(Boolean);
+  }
+  const block = body.match(/^ {4}needs:\n((?: {6}- .*\n?)+)/m);
+  return block
+    ? block[1]
+        .split('\n')
+        .map((line) => line.replace(/^ {6}- /, '').trim())
+        .filter(Boolean)
+    : [];
+}
+
+/** Jobs the stage's pipeline-status gate passes to `--required`. */
+function requiredStageJobs(jobs) {
+  const status = jobs.find((job) => job.name === 'pipeline-status');
+  const match = status && status.body.match(/--required ([\w,-]+)/);
+  return match ? match[1].split(',') : [];
+}
+
+/** `workflow_dispatch` inputs as `{ name, body }` blocks. */
+function dispatchInputs(workflow) {
+  const section = workflow.match(
+    /^ {2}workflow_dispatch:\n {4}inputs:\n((?: {6}.*\n| *\n)+)/m
+  );
+  if (!section) {
+    return [];
+  }
+  return section[1]
+    .split(/^(?= {6}[\w-]+:$)/m)
+    .map((block) => {
+      const header = block.match(/^ {6}([\w-]+):$/m);
+      return header ? { name: header[1], body: block } : null;
+    })
+    .filter(Boolean);
+}
+
 const workflows = listWorkflows();
 
 describe('CI workflow invariants', () => {
@@ -449,6 +494,38 @@ describe('CI workflow invariants', () => {
     );
   });
 
+  it('fails a pull request whose Cargo.lock is out of date', () => {
+    // A release bump that rewrote only Cargo.toml left Cargo.lock behind and
+    // every later cargo run silently rewrote it (issue #234).
+    const lint = parseJobs(readWorkflow('rust.yml')).find(
+      (job) => job.name === 'lint'
+    );
+    assert.ok(lint, 'rust.yml has no lint job');
+    assert.match(lint.body, /cargo metadata --locked/);
+  });
+
+  it('reports a failed Rust test as a failed test, not low coverage', () => {
+    // Without pipefail a failing test reached the threshold check as an empty
+    // value: "Coverage % is below the 50% threshold" (issue #234).
+    const coverage = parseJobs(readWorkflow('rust.yml')).find(
+      (job) => job.name === 'coverage'
+    );
+    assert.ok(coverage, 'rust.yml has no coverage job');
+    assert.match(coverage.body, /set -o pipefail/);
+    assert.match(coverage.body, /scripts\/check-rust-coverage\.mjs/);
+    assert.doesNotMatch(
+      coverage.body,
+      /grep -oP/,
+      'parse tarpaulin output through the tested helper'
+    );
+    assert.ok(
+      coverage.body.includes(
+        'cargo-tarpaulin-bin-${{ env.TARPAULIN_VERSION }}'
+      ),
+      'an unversioned tarpaulin cache key never picks up a new release'
+    );
+  });
+
   it('parses coverage through the tested helper, not an inline grep', () => {
     const js = readWorkflow('js.yml');
     assert.doesNotMatch(
@@ -463,4 +540,131 @@ describe('CI workflow invariants', () => {
       'an unparsable coverage report must fail, not skip'
     );
   });
+  it('releases only after every check its stage requires has passed', () => {
+    // Rust Auto Release needed only [lint, test, build] and started in run
+    // 39257928573 while the tarpaulin test run was failing (issue #234).
+    for (const name of ['js.yml', 'rust.yml']) {
+      const jobs = parseJobs(readWorkflow(name));
+      const required = requiredStageJobs(jobs);
+      assert.ok(required.length > 0, `${name}: no --required list`);
+      const releases = jobs.filter(
+        (job) => WRITER_JOBS.has(job.name) && job.name !== 'changeset-pr'
+      );
+      assert.ok(releases.length > 0, `${name}: no release jobs`);
+      for (const job of releases) {
+        const needs = parseNeeds(job.body);
+        for (const check of required) {
+          assert.ok(
+            needs.includes(check),
+            `${name}: ${job.name} does not wait for ${check}`
+          );
+        }
+        // The job-level `needs.*` also sees skipped ancestors (changeset-check
+        // and changelog are skipped on push), so a wildcard check skipped
+        // every main release; only named results are reliable (issue #240).
+        assert.ok(
+          !job.body.includes('needs.*'),
+          `${name}: ${job.name} checks needs.* instead of named results`
+        );
+        for (const check of needs) {
+          assert.ok(
+            job.body.includes(`needs.${check}.result == 'success'`),
+            `${name}: ${job.name} may start without a successful ${check}`
+          );
+        }
+      }
+    }
+  });
+
+  it('fails a main run whose release was skipped although its needs succeeded', () => {
+    // Nothing was published for days while every run looked green (#240).
+    for (const [name, release] of [
+      ['js.yml', 'release'],
+      ['rust.yml', 'auto-release'],
+    ]) {
+      const jobs = parseJobs(readWorkflow(name));
+      const job = jobs.find((entry) => entry.name === release);
+      const gate = jobs.find((entry) => entry.name === 'pipeline-status');
+      assert.ok(
+        gate.body.includes(
+          `--release '${release}:${parseNeeds(job.body).join(',')}'`
+        ),
+        `${name}: pipeline-status does not check that ${release} ran`
+      );
+    }
+  });
+
+  it('gives every required dispatch input a default', () => {
+    // `gh workflow run` cannot fill a form; a required input without a
+    // default makes the dispatch API answer HTTP 422 (issue #234).
+    for (const name of workflows) {
+      for (const input of dispatchInputs(readWorkflow(name))) {
+        if (/^ {8}required: true$/m.test(input.body)) {
+          assert.match(
+            input.body,
+            /^ {8}default: /m,
+            `${name}: dispatch input "${input.name}" has no default`
+          );
+        }
+      }
+    }
+  });
+  it('opens release pull requests with a token that triggers their checks', () => {
+    // A pull request opened with the built-in GITHUB_TOKEN starts no
+    // pull_request workflows, so the changeset PR never ran its checks
+    // (issue #234; template issue #192).
+    for (const name of workflows) {
+      for (const { name: key, body } of parseJobs(readWorkflow(name))) {
+        if (!body.includes('peter-evans/create-pull-request@')) {
+          continue;
+        }
+        assert.ok(
+          !/^ {10}token: \$\{\{ secrets\.GITHUB_TOKEN \}\}/m.test(body),
+          `${name}: ${key} opens its pull request with GITHUB_TOKEN`
+        );
+        assert.ok(
+          /^ {10}token: \$\{\{ secrets\.RELEASE_PR_TOKEN \}\}/m.test(body) &&
+            body.includes('::error::RELEASE_PR_TOKEN is required'),
+          `${name}: ${key} must use RELEASE_PR_TOKEN and fail loudly without it`
+        );
+      }
+    }
+  });
+
+  it('re-runs a path-filtered workflow when a script it runs changes', () => {
+    // workflows.yml ran only on `.github/**`, so a broken
+    // scripts/install-actionlint.sh merged without the linter running.
+    for (const name of workflows) {
+      const workflow = readWorkflow(name);
+      const filters = [
+        ...workflow.matchAll(/^ {4}paths:\n((?: {6}- .*\n)+)/gm),
+      ].map((match) =>
+        match[1]
+          .split('\n')
+          .map((line) =>
+            line
+              .replace(/^ {6}- /, '')
+              .replace(/'/g, '')
+              .trim()
+          )
+          .filter(Boolean)
+      );
+      if (filters.length === 0) {
+        continue;
+      }
+      const scripts = new Set(
+        [...workflow.matchAll(/\bscripts\/[\w.-]+\.(?:sh|mjs|js)\b/g)].map(
+          (match) => match[0]
+        )
+      );
+      for (const paths of filters) {
+        for (const script of scripts) {
+          assert.ok(
+            paths.includes(script) || paths.includes('scripts/**'),
+            `${name}: ${script} changes do not trigger the workflow`
+          );
+        }
+      }
+    }
+  });
 });

package/test/command-builder-docker-cleanup.js

@@ -32,4 +32,28 @@ describe('command-builder docker cleanup forwarding', () => {
     assert.match(command, /--isolated "tmux"/);
     assert.doesNotMatch(command, /--keep-container/);
   });
+
+  it('forwards --init only to a remaining docker level (issue #244)', () => {
+    const nested = buildNextLevelCommand(
+      {
+        isolatedStack: ['screen', 'docker'],
+        imageStack: [null, 'alpine'],
+        init: true,
+      },
+      'npm test'
+    );
+    assert.match(nested, /--isolated "docker"/);
+    assert.match(nested, / --init(?: |$)/);
+
+    const consumed = buildNextLevelCommand(
+      {
+        isolatedStack: ['docker', 'tmux'],
+        imageStack: ['alpine', null],
+        init: true,
+      },
+      'npm test'
+    );
+    assert.match(consumed, /--isolated "tmux"/);
+    assert.doesNotMatch(consumed, /--init/);
+  });
 });

package/test/command-exit-codes.mjs

@@ -0,0 +1,91 @@
+import { describe, expect, it } from 'bun:test';
+import { readdirSync, readFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+
+// command-stream's `$` resolves with a non-zero `code` instead of throwing, so
+// a bare `await $`...`` - or one inside try/catch - silently ignores a failed
+// command. That made a rejected `npm publish` print "✅ Published" and a failed
+// GitHub API call print "✅ Formatted release notes" (issue #234). Every call in
+// scripts/ must either go through checked() or read the result's `.code`.
+
+const scriptsDir = join(
+  dirname(fileURLToPath(import.meta.url)),
+  '../../scripts'
+);
+
+/**
+ * Find `$` template calls whose exit code nobody looks at.
+ * @param {string} source
+ * @returns {string[]} offending lines, prefixed with their line number
+ */
+export function findUncheckedCommands(source) {
+  const lines = source.split('\n');
+  const offenders = [];
+  lines.forEach((line, index) => {
+    const trimmed = line.trim();
+    if (
+      !trimmed.includes('$`') ||
+      trimmed.startsWith('*') ||
+      trimmed.startsWith('//')
+    ) {
+      return;
+    }
+    const previous = index > 0 ? lines[index - 1] : '';
+    if (/\bchecked\(/.test(line) || /\bchecked\(\s*$/.test(previous)) {
+      return;
+    }
+    const assigned = `${previous}\n${line}`.match(
+      /(?:const|let)\s+(\w+)\s*=\s*(?:await\s+)?$|(?:const|let)\s+(\w+)\s*=\s*(?:await\s+)?\$`/m
+    );
+    const name = assigned && (assigned[1] || assigned[2]);
+    const rest = lines.slice(index + 1).join('\n');
+    if (name && new RegExp(`\\b${name}\\.code\\b`).test(rest)) {
+      return;
+    }
+    offenders.push(`${index + 1}: ${trimmed}`);
+  });
+  return offenders;
+}
+
+describe('command exit codes in release scripts', () => {
+  it('flags a bare call and a try/catch-wrapped call', () => {
+    const source = [
+      'try {',
+      '  await $`npm run changeset:publish`;',
+      '} catch {}',
+      'const r = await $`gh api x`.run({ capture: true });',
+      'console.log(r.stdout);',
+    ].join('\n');
+    expect(findUncheckedCommands(source)).toEqual([
+      '2: await $`npm run changeset:publish`;',
+      '4: const r = await $`gh api x`.run({ capture: true });',
+    ]);
+  });
+
+  it('accepts checked() and an inspected .code', () => {
+    const source = [
+      'await checked($`git push`, "git push");',
+      'await checked(',
+      '  $`git fetch`,',
+      '  "git fetch"',
+      ');',
+      'const ancestry =',
+      '  await $`git merge-base --is-ancestor a b`.run({ capture: true });',
+      'if (ancestry.code !== 0) throw new Error("x");',
+      '// await $`ignored in a comment`',
+    ].join('\n');
+    expect(findUncheckedCommands(source)).toEqual([]);
+  });
+
+  it('every command in scripts/*.mjs has its exit code checked', () => {
+    const offenders = readdirSync(scriptsDir)
+      .filter((file) => file.endsWith('.mjs'))
+      .flatMap((file) =>
+        findUncheckedCommands(readFileSync(join(scriptsDir, file), 'utf8')).map(
+          (offender) => `scripts/${file}:${offender}`
+        )
+      );
+    expect(offenders).toEqual([]);
+  });
+});

package/test/docker-runtime-options.js

@@ -303,6 +303,7 @@ describe('buildDockerRuntimeMetadata', () => {
       labels: null,
       commandHandoff: null,
       privileged: null,
+      init: null,
       network: null,
       networks: null,
       networkAliases: null,
@@ -332,6 +333,7 @@ describe('buildDockerRuntimeMetadata', () => {
         mounts: ['type=bind,src=/h,dst=/c'],
         env: ['FOO=bar'],
         privileged: true,
+        init: null,
         network: 'hive-formal-ai',
         networks: ['hive-formal-ai', 'public-egress'],
         networkAliases: ['formal-ai', 'checker'],

package/test/docker-snapshot-safety.js

@@ -1,3 +1,5 @@
+// Own snapshot lock even without the bunfig.toml preload (issue #234).
+require('./setup/private-snapshot-lock');
 const { test } = require('node:test');
 const assert = require('node:assert/strict');
 const fs = require('node:fs');
@@ -104,3 +106,40 @@ test('snapshot lock is separate from store locks and excludes concurrent process
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });
+
+test('tests never share the host-wide snapshot lock (issue #234)', () => {
+  // bunfig.toml preloads test/setup/private-snapshot-lock.js. Without it a
+  // real `start --resume` holding the default lock failed every resume test.
+  const lockPath = process.env.START_SNAPSHOT_LOCK;
+  assert.ok(lockPath, 'START_SNAPSHOT_LOCK is not set by the test preload');
+  assert.notEqual(
+    lockPath,
+    path.join(
+      process.platform === 'win32' ? os.tmpdir() : '/tmp',
+      'start-command-docker-snapshot.lock'
+    )
+  );
+  const lock = acquireSnapshotLock({ holder: 'issue-234' });
+  try {
+    assert.ok(fs.existsSync(lockPath));
+  } finally {
+    lock.release();
+  }
+});
+
+test('every snapshot test requires its private lock itself (issue #234)', () => {
+  // `bun test ./js/test/x.js` from the repository root skips js/bunfig.toml,
+  // so the preload alone left 18 tests on the host-wide lock.
+  const dir = __dirname;
+  const offenders = fs
+    .readdirSync(dir)
+    .filter((name) => name.endsWith('.js'))
+    .filter((name) => {
+      const source = fs.readFileSync(path.join(dir, name), 'utf8');
+      return (
+        /\b(resumeExecution|acquireSnapshotLock)\(/.test(source) &&
+        !source.includes("require('./setup/private-snapshot-lock')")
+      );
+    });
+  assert.deepEqual(offenders, []);
+});

package/test/execution-resume.js

@@ -2,6 +2,8 @@
  * Tests for --resume and --resume-all (issue #162)
  */
 
+// Own snapshot lock even without the bunfig.toml preload (issue #234).
+require('./setup/private-snapshot-lock');
 const { test, describe } = require('node:test');
 const assert = require('node:assert');
 const {

package/test/fixtures/fake-npm.sh

@@ -0,0 +1,64 @@
+#!/bin/sh
+# Fake `npm` for js/test/npm-publish.mjs (issue #234). State lives in
+# $FAKE_NPM_STATE: `published` marks the version as on the registry,
+# `mode` picks how `npm run changeset:publish` behaves, `calls` logs argv.
+# `pending` holds how many more `npm view` calls miss a version that has
+# landed but not yet propagated to the registry's read path.
+# Any other command goes to $REAL_NPM when set (use-m runs `npm root -g`).
+state="${FAKE_NPM_STATE:?}"
+echo "$*" >> "$state/calls"
+case "$1" in
+  view)
+    if [ -f "$state/outage" ]; then
+      echo "npm error code ECONNRESET" >&2
+      exit 1
+    fi
+    if [ -f "$state/pending" ]; then
+      left="$(cat "$state/pending")"
+      if [ "$left" -le 1 ]; then
+        rm "$state/pending"
+        echo "$FAKE_NPM_VERSION" > "$state/published"
+      else
+        echo $((left - 1)) > "$state/pending"
+      fi
+      echo "npm error code E404" >&2
+      exit 1
+    fi
+    if [ -f "$state/published" ]; then
+      cat "$state/published"
+      exit 0
+    fi
+    echo "npm error code E404" >&2
+    exit 1
+    ;;
+  run)
+    mode="$(cat "$state/mode" 2>/dev/null || echo succeed)"
+    case "$mode" in
+      succeed) echo "$FAKE_NPM_VERSION" > "$state/published"; exit 0 ;;
+      fail) echo "npm error code E403" >&2; exit 1 ;;
+      exit-0-without-publishing) exit 0 ;;
+      fail-after-landing) echo "$FAKE_NPM_VERSION" > "$state/published"; exit 1 ;;
+      land-late) echo 20 > "$state/pending"; exit 0 ;;
+      time-out-while-landing)
+        if [ -f "$state/pending" ] || [ -f "$state/published" ]; then
+          echo "npm error code E403" >&2
+          echo "npm error You cannot publish over the previously published versions: $FAKE_NPM_VERSION." >&2
+          exit 1
+        fi
+        echo 20 > "$state/pending"
+        echo "npm error code ETIMEDOUT" >&2
+        exit 1
+        ;;
+      fail-once)
+        echo succeed > "$state/mode"
+        echo "npm error code E503" >&2
+        exit 1
+        ;;
+    esac
+    ;;
+esac
+if [ -n "${REAL_NPM:-}" ]; then
+  exec "$REAL_NPM" "$@"
+fi
+echo "fake npm: unexpected arguments: $*" >&2
+exit 2

package/test/fixtures/lychee-report.md

@@ -0,0 +1,39 @@
+# Link Checker Report
+
+| Status         | Count |
+| -------------- | ----- |
+| 🔍 Total       | 120   |
+| ✅ Successful  | 108   |
+| ⏳ Timeouts    | 0     |
+| 🔀 Redirected  | 6     |
+| 👻 Excluded    | 2     |
+| ❓ Unknown     | 0     |
+| 🚫 Errors      | 4     |
+| ⛔ Unsupported | 0     |
+
+## Errors per input
+
+### Errors in csharp/docs/index.md
+
+- [ERROR] <file:///home/runner/work/repo/repo/csharp/docs/api/Foundation.Data.Doublets.Cli.yml> (at 15:12) | File not found. Check if file exists and path is correct
+
+### Errors in js/index.html
+
+- [ERROR] <error:> (at 10:49) | Cannot resolve root-relative link '/favicon.svg': To resolve root-relative links in local files, provide a root dir
+
+### Errors in README.md
+
+- [404] <https://example.com/csharp/> (at 48:130) | Rejected status code: 404 Not Found
+- [404] <https://example.com/rust/link_cli/> (at 49:62) | Rejected status code: 404 Not Found
+
+## Redirects per input
+
+### Redirects in README.md
+
+- https://example.com/docs --[302]--> https://example.com/docs/latest/
+- https://example.com/protocols --[301]--> https://example.com/links-notation
+- https://example.com/articles/804617 --[301]--> https://example.com/articles/804617/ --[302]--> https://example.com/companies/articles/804617/
+
+### Redirects in rust/README.md
+
+- https://example.com/docs --[302]--> https://example.com/docs/latest/

package/test/javascript-first-ci.js

@@ -9,6 +9,7 @@ const {
 } = require('../../scripts/check-javascript-first.mjs');
 const {
   checkFeatureChanges,
+  checkRegressionPairs,
 } = require('../../scripts/check-feature-parity.mjs');
 
 const root = resolve(__dirname, '../..');
@@ -178,6 +179,44 @@ describe('JavaScript first CI gate', () => {
     assert.equal(check.status, 0);
   });
 
+  const releaseCheck = (isMain, release, test = 'success') =>
+    spawnSync(
+      process.execPath,
+      [
+        resolve(root, 'scripts/check-stage-status.mjs'),
+        '--required',
+        'test',
+        '--release',
+        'release:test',
+      ],
+      {
+        encoding: 'utf8',
+        env: {
+          ...process.env,
+          IS_MAIN: String(isMain),
+          NEEDS_JSON: JSON.stringify({
+            test: { result: test },
+            release: { result: release },
+          }),
+        },
+      }
+    );
+
+  it('fails a main push whose release was skipped after its needs passed', () => {
+    // Every main release was silently skipped since #234 (issue #240).
+    const check = releaseCheck(true, 'skipped');
+    assert.equal(check.status, 1);
+    assert.match(check.stderr, /release was skipped on a main push/);
+    // The terms of the release condition are printed for the next skip.
+    assert.match(check.stdout, /needs\.test\.result=success/);
+    assert.match(check.stdout, /release: skipped; expected to run: true/);
+  });
+
+  it('accepts a skipped release outside main pushes and a run release on main', () => {
+    assert.equal(releaseCheck(false, 'skipped').status, 0);
+    assert.equal(releaseCheck(true, 'success').status, 0);
+  });
+
   it('rejects a change to only one implementation of a feature', () => {
     const features = [
       {
@@ -194,6 +233,36 @@ describe('JavaScript first CI gate', () => {
     );
   });
 
+  it('keeps both halves of a regression test under one feature', () => {
+    const feature = (id, js, rust) => ({
+      id,
+      javascript: { implementation: [], tests: js },
+      rust: { implementation: [], tests: rust },
+    });
+    assert.equal(
+      checkRegressionPairs([
+        feature('a', ['js/test/regression-193.js'], []),
+        feature('b', [], ['rust/tests/regression_193.rs']),
+      ]).length,
+      1
+    );
+    assert.deepEqual(
+      checkRegressionPairs([
+        feature(
+          'a',
+          ['js/test/regression-201.js'],
+          ['rust/tests/regression_201.rs']
+        ),
+        feature('b', [], ['rust/tests/regression_201.rs']),
+      ]),
+      []
+    );
+    const manifest = JSON.parse(
+      readFileSync(resolve(root, 'parity/features.json'), 'utf8')
+    );
+    assert.deepEqual(checkRegressionPairs(manifest.features), []);
+  });
+
   it('makes Rust callable only after the complete JavaScript stage', () => {
     const files = workflows();
     assert.deepEqual(Object.keys(files['rust.yml'].on), ['workflow_call']);