start-command 0.38.0 → 0.39.1

package/test/check-rust-coverage.mjs

@@ -0,0 +1,71 @@
+import { describe, expect, it } from 'bun:test';
+
+import {
+  checkCoverage,
+  parseTarpaulinCoverage,
+} from '../../scripts/check-rust-coverage.mjs';
+
+// Tail of a passing cargo-tarpaulin 0.37.5 run (Rust CI/CD, run 39256972823).
+const PASSING_LOG = `|| src/lib/usage.rs: 0/1
+|| src/lib/user_manager.rs: 48/170
+||
+73.81% coverage, 6296/8530 lines covered
+`;
+
+// Tail of the failing run on main (run 39257928573): a test failed, tarpaulin
+// stopped before its summary, and the old step reported
+// "Coverage % is below the 50% threshold" (issue #234).
+const FAILED_TEST_LOG = `failures:
+    reservation_failure_after_cleanup_preserves_restart_state
+
+test result: FAILED. 5 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.13s
+
+Error: "Test failed during run"
+`;
+
+describe('check-rust-coverage', () => {
+  it('parses the tarpaulin summary line', () => {
+    expect(parseTarpaulinCoverage(PASSING_LOG)).toBe(73.81);
+  });
+
+  it('uses the last summary when several are printed', () => {
+    const log =
+      '10.00% coverage, 1/10 lines covered\r\n60.5% coverage, 6/10 lines covered\r\n';
+    expect(parseTarpaulinCoverage(log)).toBe(60.5);
+  });
+
+  it('ignores lines that only mention coverage', () => {
+    expect(parseTarpaulinCoverage('Coverage: 73.81%\n')).toBeNull();
+    expect(parseTarpaulinCoverage('')).toBeNull();
+    expect(parseTarpaulinCoverage(undefined)).toBeNull();
+  });
+
+  it('passes when coverage meets the threshold', () => {
+    const result = checkCoverage(PASSING_LOG, 50);
+    expect(result.ok).toBe(true);
+    expect(result.message).toBe('✅ Coverage 73.81% meets the 50% threshold');
+  });
+
+  it('fails when coverage is below the threshold', () => {
+    const result = checkCoverage(PASSING_LOG, 80);
+    expect(result.ok).toBe(false);
+    expect(result.message).toBe(
+      '❌ Coverage 73.81% is below the 80% threshold'
+    );
+  });
+
+  it('reports a failed test instead of an empty coverage drop (issue #234)', () => {
+    const result = checkCoverage(FAILED_TEST_LOG, 50);
+    expect(result.ok).toBe(false);
+    expect(result.coverage).toBeNull();
+    expect(result.message).toContain('a test failed');
+    expect(result.message).not.toContain('below the');
+    expect(result.message).not.toContain('Coverage %');
+  });
+
+  it('fails when the log has no summary for another reason', () => {
+    const result = checkCoverage('error: could not compile', 50);
+    expect(result.ok).toBe(false);
+    expect(result.message).toContain('Could not determine coverage');
+  });
+});

package/test/check-web-archive.mjs

@@ -0,0 +1,154 @@
+// Regression tests for the lychee report parser used by the Broken Link
+// Checker workflow. A lychee error without an http(s) URL - a missing local
+// file, an unresolvable root-relative link - has no Wayback equivalent. Such
+// errors must still be reported, and must keep the check red.
+import assert from 'node:assert/strict';
+import { describe, it } from 'bun:test';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { spawnSync } from 'node:child_process';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  extractBrokenLinks,
+  extractBrokenUrls,
+  extractErrorsSection,
+} from '../../scripts/check-web-archive.mjs';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const report = readFileSync(
+  join(here, 'fixtures', 'lychee-report.md'),
+  'utf-8'
+);
+
+describe('extractErrorsSection', () => {
+  it('stops at the next top-level heading', () => {
+    const section = extractErrorsSection(report);
+    assert.ok(section.includes('Errors in README.md'));
+    assert.ok(
+      !section.includes('Redirects per input'),
+      'the redirects section must not leak into the errors section'
+    );
+  });
+
+  it('falls back to the whole document when the heading is absent', () => {
+    const legacy = '# Link report\n\n* [404] https://broken.example/legacy\n';
+    assert.equal(extractErrorsSection(legacy), legacy);
+  });
+});
+
+describe('extractBrokenUrls', () => {
+  it('ignores successful redirects outside the errors section', () => {
+    const shortReport = `## Errors per input
+
+### Errors in docs/reference.md
+
+* [502] <https://broken.example/reference> (at 1:1) | Rejected status code: 502
+
+## Redirects per input
+
+### Redirects in README.md
+
+* https://working.example/old --[301]--> https://working.example/current
+`;
+
+    assert.deepEqual(extractBrokenUrls(shortReport), [
+      'https://broken.example/reference',
+    ]);
+  });
+
+  it('parses the full document when the errors section is absent', () => {
+    const legacyReport = `# Link report
+
+* [404] https://broken.example/legacy
+`;
+
+    assert.deepEqual(extractBrokenUrls(legacyReport), [
+      'https://broken.example/legacy',
+    ]);
+  });
+
+  it('extracts every http error from a full report exactly once', () => {
+    assert.deepEqual(extractBrokenUrls(report), [
+      'https://example.com/csharp/',
+      'https://example.com/rust/link_cli/',
+    ]);
+  });
+});
+
+describe('extractBrokenLinks', () => {
+  it('reports errors that the Wayback Machine cannot answer', () => {
+    const { others } = extractBrokenLinks(report);
+    assert.equal(
+      others.length,
+      2,
+      'the missing DocFX file and the unresolvable root-relative link must not be silently dropped'
+    );
+    assert.ok(
+      others.some((link) => link.endsWith('Foundation.Data.Doublets.Cli.yml')),
+      'the missing local file must be reported'
+    );
+    assert.ok(
+      others.includes('error:'),
+      'the unresolvable root-relative link must be reported'
+    );
+  });
+
+  it('never classifies a non-http error as a URL', () => {
+    const localOnly = `## Errors per input
+
+### Errors in docs/index.md
+
+* [ERROR] <file:///repo/docs/api/Some.Type.yml> (at 15:12) | File not found. Check if file exists and path is correct
+`;
+
+    const { urls, others } = extractBrokenLinks(localOnly);
+    assert.deepEqual(urls, []);
+    assert.deepEqual(others, ['file:///repo/docs/api/Some.Type.yml']);
+  });
+
+  it('matches the error count lychee itself reports', () => {
+    const { urls, others } = extractBrokenLinks(report);
+    const reported = Number(/🚫 Errors\s*\|\s*(\d+)/.exec(report)[1]);
+    assert.equal(urls.length + others.length, reported);
+  });
+});
+
+describe('check-web-archive.mjs end to end', () => {
+  it('fails when the only lychee errors have no http URL to archive', async () => {
+    const scriptPath = join(
+      here,
+      '..',
+      '..',
+      'scripts',
+      'check-web-archive.mjs'
+    );
+    const workDir = mkdtempSync(join(tmpdir(), 'web-archive-'));
+    const reportPath = join(workDir, 'out.md');
+    const outputPath = join(workDir, 'github-output.txt');
+    writeFileSync(
+      reportPath,
+      `## Errors per input
+
+### Errors in docs/index.md
+
+* [ERROR] <file:///repo/docs/api/Some.Type.yml> (at 15:12) | File not found. Check if file exists and path is correct
+`
+    );
+    writeFileSync(outputPath, '');
+
+    const result = spawnSync(process.execPath, [scriptPath], {
+      encoding: 'utf-8',
+      env: {
+        ...process.env,
+        LYCHEE_OUTPUT: reportPath,
+        GITHUB_OUTPUT: outputPath,
+      },
+    });
+
+    assert.equal(result.status, 1, result.stdout + result.stderr);
+    assert.match(readFileSync(outputPath, 'utf-8'), /all_archived=false/);
+    rmSync(workDir, { recursive: true, force: true });
+  });
+});

package/test/ci-workflow-invariants.js

@@ -127,6 +127,51 @@ function inRunBlock(workflow, index) {
   return false;
 }
 
+/** The `needs:` of a job, written inline (`[a, b]`) or as a block list. */
+function parseNeeds(body) {
+  const inline = jobKey(body, 'needs');
+  if (inline === null) {
+    return [];
+  }
+  if (inline) {
+    return inline
+      .split(/[,[\]]/)
+      .map((entry) => entry.trim())
+      .filter(Boolean);
+  }
+  const block = body.match(/^ {4}needs:\n((?: {6}- .*\n?)+)/m);
+  return block
+    ? block[1]
+        .split('\n')
+        .map((line) => line.replace(/^ {6}- /, '').trim())
+        .filter(Boolean)
+    : [];
+}
+
+/** Jobs the stage's pipeline-status gate passes to `--required`. */
+function requiredStageJobs(jobs) {
+  const status = jobs.find((job) => job.name === 'pipeline-status');
+  const match = status && status.body.match(/--required ([\w,-]+)/);
+  return match ? match[1].split(',') : [];
+}
+
+/** `workflow_dispatch` inputs as `{ name, body }` blocks. */
+function dispatchInputs(workflow) {
+  const section = workflow.match(
+    /^ {2}workflow_dispatch:\n {4}inputs:\n((?: {6}.*\n| *\n)+)/m
+  );
+  if (!section) {
+    return [];
+  }
+  return section[1]
+    .split(/^(?= {6}[\w-]+:$)/m)
+    .map((block) => {
+      const header = block.match(/^ {6}([\w-]+):$/m);
+      return header ? { name: header[1], body: block } : null;
+    })
+    .filter(Boolean);
+}
+
 const workflows = listWorkflows();
 
 describe('CI workflow invariants', () => {
@@ -449,6 +494,38 @@ describe('CI workflow invariants', () => {
     );
   });
 
+  it('fails a pull request whose Cargo.lock is out of date', () => {
+    // A release bump that rewrote only Cargo.toml left Cargo.lock behind and
+    // every later cargo run silently rewrote it (issue #234).
+    const lint = parseJobs(readWorkflow('rust.yml')).find(
+      (job) => job.name === 'lint'
+    );
+    assert.ok(lint, 'rust.yml has no lint job');
+    assert.match(lint.body, /cargo metadata --locked/);
+  });
+
+  it('reports a failed Rust test as a failed test, not low coverage', () => {
+    // Without pipefail a failing test reached the threshold check as an empty
+    // value: "Coverage % is below the 50% threshold" (issue #234).
+    const coverage = parseJobs(readWorkflow('rust.yml')).find(
+      (job) => job.name === 'coverage'
+    );
+    assert.ok(coverage, 'rust.yml has no coverage job');
+    assert.match(coverage.body, /set -o pipefail/);
+    assert.match(coverage.body, /scripts\/check-rust-coverage\.mjs/);
+    assert.doesNotMatch(
+      coverage.body,
+      /grep -oP/,
+      'parse tarpaulin output through the tested helper'
+    );
+    assert.ok(
+      coverage.body.includes(
+        'cargo-tarpaulin-bin-${{ env.TARPAULIN_VERSION }}'
+      ),
+      'an unversioned tarpaulin cache key never picks up a new release'
+    );
+  });
+
   it('parses coverage through the tested helper, not an inline grep', () => {
     const js = readWorkflow('js.yml');
     assert.doesNotMatch(
@@ -463,4 +540,131 @@ describe('CI workflow invariants', () => {
       'an unparsable coverage report must fail, not skip'
     );
   });
+  it('releases only after every check its stage requires has passed', () => {
+    // Rust Auto Release needed only [lint, test, build] and started in run
+    // 39257928573 while the tarpaulin test run was failing (issue #234).
+    for (const name of ['js.yml', 'rust.yml']) {
+      const jobs = parseJobs(readWorkflow(name));
+      const required = requiredStageJobs(jobs);
+      assert.ok(required.length > 0, `${name}: no --required list`);
+      const releases = jobs.filter(
+        (job) => WRITER_JOBS.has(job.name) && job.name !== 'changeset-pr'
+      );
+      assert.ok(releases.length > 0, `${name}: no release jobs`);
+      for (const job of releases) {
+        const needs = parseNeeds(job.body);
+        for (const check of required) {
+          assert.ok(
+            needs.includes(check),
+            `${name}: ${job.name} does not wait for ${check}`
+          );
+        }
+        // The job-level `needs.*` also sees skipped ancestors (changeset-check
+        // and changelog are skipped on push), so a wildcard check skipped
+        // every main release; only named results are reliable (issue #240).
+        assert.ok(
+          !job.body.includes('needs.*'),
+          `${name}: ${job.name} checks needs.* instead of named results`
+        );
+        for (const check of needs) {
+          assert.ok(
+            job.body.includes(`needs.${check}.result == 'success'`),
+            `${name}: ${job.name} may start without a successful ${check}`
+          );
+        }
+      }
+    }
+  });
+
+  it('fails a main run whose release was skipped although its needs succeeded', () => {
+    // Nothing was published for days while every run looked green (#240).
+    for (const [name, release] of [
+      ['js.yml', 'release'],
+      ['rust.yml', 'auto-release'],
+    ]) {
+      const jobs = parseJobs(readWorkflow(name));
+      const job = jobs.find((entry) => entry.name === release);
+      const gate = jobs.find((entry) => entry.name === 'pipeline-status');
+      assert.ok(
+        gate.body.includes(
+          `--release '${release}:${parseNeeds(job.body).join(',')}'`
+        ),
+        `${name}: pipeline-status does not check that ${release} ran`
+      );
+    }
+  });
+
+  it('gives every required dispatch input a default', () => {
+    // `gh workflow run` cannot fill a form; a required input without a
+    // default makes the dispatch API answer HTTP 422 (issue #234).
+    for (const name of workflows) {
+      for (const input of dispatchInputs(readWorkflow(name))) {
+        if (/^ {8}required: true$/m.test(input.body)) {
+          assert.match(
+            input.body,
+            /^ {8}default: /m,
+            `${name}: dispatch input "${input.name}" has no default`
+          );
+        }
+      }
+    }
+  });
+  it('opens release pull requests with a token that triggers their checks', () => {
+    // A pull request opened with the built-in GITHUB_TOKEN starts no
+    // pull_request workflows, so the changeset PR never ran its checks
+    // (issue #234; template issue #192).
+    for (const name of workflows) {
+      for (const { name: key, body } of parseJobs(readWorkflow(name))) {
+        if (!body.includes('peter-evans/create-pull-request@')) {
+          continue;
+        }
+        assert.ok(
+          !/^ {10}token: \$\{\{ secrets\.GITHUB_TOKEN \}\}/m.test(body),
+          `${name}: ${key} opens its pull request with GITHUB_TOKEN`
+        );
+        assert.ok(
+          /^ {10}token: \$\{\{ secrets\.RELEASE_PR_TOKEN \}\}/m.test(body) &&
+            body.includes('::error::RELEASE_PR_TOKEN is required'),
+          `${name}: ${key} must use RELEASE_PR_TOKEN and fail loudly without it`
+        );
+      }
+    }
+  });
+
+  it('re-runs a path-filtered workflow when a script it runs changes', () => {
+    // workflows.yml ran only on `.github/**`, so a broken
+    // scripts/install-actionlint.sh merged without the linter running.
+    for (const name of workflows) {
+      const workflow = readWorkflow(name);
+      const filters = [
+        ...workflow.matchAll(/^ {4}paths:\n((?: {6}- .*\n)+)/gm),
+      ].map((match) =>
+        match[1]
+          .split('\n')
+          .map((line) =>
+            line
+              .replace(/^ {6}- /, '')
+              .replace(/'/g, '')
+              .trim()
+          )
+          .filter(Boolean)
+      );
+      if (filters.length === 0) {
+        continue;
+      }
+      const scripts = new Set(
+        [...workflow.matchAll(/\bscripts\/[\w.-]+\.(?:sh|mjs|js)\b/g)].map(
+          (match) => match[0]
+        )
+      );
+      for (const paths of filters) {
+        for (const script of scripts) {
+          assert.ok(
+            paths.includes(script) || paths.includes('scripts/**'),
+            `${name}: ${script} changes do not trigger the workflow`
+          );
+        }
+      }
+    }
+  });
 });

package/test/command-builder-docker-cleanup.js

@@ -32,4 +32,28 @@ describe('command-builder docker cleanup forwarding', () => {
     assert.match(command, /--isolated "tmux"/);
     assert.doesNotMatch(command, /--keep-container/);
   });
+
+  it('forwards --init only to a remaining docker level (issue #244)', () => {
+    const nested = buildNextLevelCommand(
+      {
+        isolatedStack: ['screen', 'docker'],
+        imageStack: [null, 'alpine'],
+        init: true,
+      },
+      'npm test'
+    );
+    assert.match(nested, /--isolated "docker"/);
+    assert.match(nested, / --init(?: |$)/);
+
+    const consumed = buildNextLevelCommand(
+      {
+        isolatedStack: ['docker', 'tmux'],
+        imageStack: ['alpine', null],
+        init: true,
+      },
+      'npm test'
+    );
+    assert.match(consumed, /--isolated "tmux"/);
+    assert.doesNotMatch(consumed, /--init/);
+  });
 });

package/test/command-exit-codes.mjs

@@ -0,0 +1,91 @@
+import { describe, expect, it } from 'bun:test';
+import { readdirSync, readFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+
+// command-stream's `$` resolves with a non-zero `code` instead of throwing, so
+// a bare `await $`...`` - or one inside try/catch - silently ignores a failed
+// command. That made a rejected `npm publish` print "✅ Published" and a failed
+// GitHub API call print "✅ Formatted release notes" (issue #234). Every call in
+// scripts/ must either go through checked() or read the result's `.code`.
+
+const scriptsDir = join(
+  dirname(fileURLToPath(import.meta.url)),
+  '../../scripts'
+);
+
+/**
+ * Find `$` template calls whose exit code nobody looks at.
+ * @param {string} source
+ * @returns {string[]} offending lines, prefixed with their line number
+ */
+export function findUncheckedCommands(source) {
+  const lines = source.split('\n');
+  const offenders = [];
+  lines.forEach((line, index) => {
+    const trimmed = line.trim();
+    if (
+      !trimmed.includes('$`') ||
+      trimmed.startsWith('*') ||
+      trimmed.startsWith('//')
+    ) {
+      return;
+    }
+    const previous = index > 0 ? lines[index - 1] : '';
+    if (/\bchecked\(/.test(line) || /\bchecked\(\s*$/.test(previous)) {
+      return;
+    }
+    const assigned = `${previous}\n${line}`.match(
+      /(?:const|let)\s+(\w+)\s*=\s*(?:await\s+)?$|(?:const|let)\s+(\w+)\s*=\s*(?:await\s+)?\$`/m
+    );
+    const name = assigned && (assigned[1] || assigned[2]);
+    const rest = lines.slice(index + 1).join('\n');
+    if (name && new RegExp(`\\b${name}\\.code\\b`).test(rest)) {
+      return;
+    }
+    offenders.push(`${index + 1}: ${trimmed}`);
+  });
+  return offenders;
+}
+
+describe('command exit codes in release scripts', () => {
+  it('flags a bare call and a try/catch-wrapped call', () => {
+    const source = [
+      'try {',
+      '  await $`npm run changeset:publish`;',
+      '} catch {}',
+      'const r = await $`gh api x`.run({ capture: true });',
+      'console.log(r.stdout);',
+    ].join('\n');
+    expect(findUncheckedCommands(source)).toEqual([
+      '2: await $`npm run changeset:publish`;',
+      '4: const r = await $`gh api x`.run({ capture: true });',
+    ]);
+  });
+
+  it('accepts checked() and an inspected .code', () => {
+    const source = [
+      'await checked($`git push`, "git push");',
+      'await checked(',
+      '  $`git fetch`,',
+      '  "git fetch"',
+      ');',
+      'const ancestry =',
+      '  await $`git merge-base --is-ancestor a b`.run({ capture: true });',
+      'if (ancestry.code !== 0) throw new Error("x");',
+      '// await $`ignored in a comment`',
+    ].join('\n');
+    expect(findUncheckedCommands(source)).toEqual([]);
+  });
+
+  it('every command in scripts/*.mjs has its exit code checked', () => {
+    const offenders = readdirSync(scriptsDir)
+      .filter((file) => file.endsWith('.mjs'))
+      .flatMap((file) =>
+        findUncheckedCommands(readFileSync(join(scriptsDir, file), 'utf8')).map(
+          (offender) => `scripts/${file}:${offender}`
+        )
+      );
+    expect(offenders).toEqual([]);
+  });
+});

package/test/docker-runtime-options.js

@@ -303,6 +303,7 @@ describe('buildDockerRuntimeMetadata', () => {
       labels: null,
       commandHandoff: null,
       privileged: null,
+      init: null,
       network: null,
       networks: null,
       networkAliases: null,
@@ -332,6 +333,7 @@ describe('buildDockerRuntimeMetadata', () => {
         mounts: ['type=bind,src=/h,dst=/c'],
         env: ['FOO=bar'],
         privileged: true,
+        init: null,
         network: 'hive-formal-ai',
         networks: ['hive-formal-ai', 'public-egress'],
         networkAliases: ['formal-ai', 'checker'],

package/test/docker-snapshot-safety.js

@@ -1,3 +1,5 @@
+// Own snapshot lock even without the bunfig.toml preload (issue #234).
+require('./setup/private-snapshot-lock');
 const { test } = require('node:test');
 const assert = require('node:assert/strict');
 const fs = require('node:fs');
@@ -104,3 +106,40 @@ test('snapshot lock is separate from store locks and excludes concurrent process
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });
+
+test('tests never share the host-wide snapshot lock (issue #234)', () => {
+  // bunfig.toml preloads test/setup/private-snapshot-lock.js. Without it a
+  // real `start --resume` holding the default lock failed every resume test.
+  const lockPath = process.env.START_SNAPSHOT_LOCK;
+  assert.ok(lockPath, 'START_SNAPSHOT_LOCK is not set by the test preload');
+  assert.notEqual(
+    lockPath,
+    path.join(
+      process.platform === 'win32' ? os.tmpdir() : '/tmp',
+      'start-command-docker-snapshot.lock'
+    )
+  );
+  const lock = acquireSnapshotLock({ holder: 'issue-234' });
+  try {
+    assert.ok(fs.existsSync(lockPath));
+  } finally {
+    lock.release();
+  }
+});
+
+test('every snapshot test requires its private lock itself (issue #234)', () => {
+  // `bun test ./js/test/x.js` from the repository root skips js/bunfig.toml,
+  // so the preload alone left 18 tests on the host-wide lock.
+  const dir = __dirname;
+  const offenders = fs
+    .readdirSync(dir)
+    .filter((name) => name.endsWith('.js'))
+    .filter((name) => {
+      const source = fs.readFileSync(path.join(dir, name), 'utf8');
+      return (
+        /\b(resumeExecution|acquireSnapshotLock)\(/.test(source) &&
+        !source.includes("require('./setup/private-snapshot-lock')")
+      );
+    });
+  assert.deepEqual(offenders, []);
+});

package/test/execution-resume.js

@@ -2,6 +2,8 @@
  * Tests for --resume and --resume-all (issue #162)
  */
 
+// Own snapshot lock even without the bunfig.toml preload (issue #234).
+require('./setup/private-snapshot-lock');
 const { test, describe } = require('node:test');
 const assert = require('node:assert');
 const {