17068fc89e
- Enrol both skill gates in the repo's gate-integrity vouch cycle. A gate that stops being invoked fails silently with every fixture test green, which is the failure the existing cycle exists to prevent. `verify:format-coverage` now vouches for `verify:skills`, `verify:skills` vouches back, and it additionally asserts the two links nothing else could see: `verify:skills:cli` present in `local:gate` and in the workflow — neither is reachable from `validate` or from any test. `checkWiring` is pure and unit-tested, with a live case against the real package.json and workflow so the fixtures cannot drift. All four links verified by mutation. - The existing sibling-vouch fixture is now a table over every sibling, so adding a fourth guard later does not need a new test. - release skill: stop hard-coding `2.3.0`, which has already shipped — the tag command aborted on an existing tag and the branch template named the wrong release. Both now read the version from `package.json` (the tag from `origin/main`'s), with a warning never to copy a version out of the file. Signed-off-by: cliffhall <cliff@futurescale.com>
99 lines
3.4 KiB
JavaScript
99 lines
3.4 KiB
JavaScript
// Regression tests for `verify-format-coverage`'s sibling-guard vouch (Copilot,
|
|
// #1962). The three root guards form a cycle so that dropping any one from
|
|
// `validate` is caught by another — but the vouch branch itself had no test, so
|
|
// a typo in a sibling's name would leave `test:scripts` green while that guard
|
|
// silently stopped being enforced. That is the same "a gate that stops gating"
|
|
// failure the cycle exists to prevent, one level up.
|
|
//
|
|
// The vouch runs before any file enumeration, so the fixture needs only a
|
|
// `package.json` and the script. Run via `npm run test:scripts`.
|
|
|
|
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { execFileSync, spawnSync } from "node:child_process";
|
|
import {
|
|
cpSync,
|
|
mkdirSync,
|
|
mkdtempSync,
|
|
realpathSync,
|
|
rmSync,
|
|
writeFileSync,
|
|
} from "node:fs";
|
|
import { tmpdir } from "node:os";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
const scriptsDir = path.dirname(fileURLToPath(import.meta.url));
|
|
|
|
/** A `validate` chain running each named guard, plus the always-present self. */
|
|
function scriptsRunning(guards) {
|
|
const scripts = {
|
|
validate: ["verify:format-coverage", ...guards]
|
|
.map((g) => `npm run ${g}`)
|
|
.join(" && "),
|
|
"verify:format-coverage": "node scripts/verify-format-coverage.mjs",
|
|
};
|
|
for (const g of guards) scripts[g] = `node scripts/${g.slice(7)}.mjs`;
|
|
return scripts;
|
|
}
|
|
|
|
/**
|
|
* Run `verify-format-coverage` in a throwaway repo whose root `validate` runs
|
|
* exactly `guards`. realpath'd because the script only executes when
|
|
* `import.meta.url` matches `process.argv[1]`, and macOS `tmpdir()` is a
|
|
* symlink — see the note in `verify-dep-lockstep.main.test.mjs`.
|
|
*/
|
|
function runWithGuards(guards) {
|
|
const dir = realpathSync(mkdtempSync(path.join(tmpdir(), "format-cov-")));
|
|
try {
|
|
writeFileSync(
|
|
path.join(dir, "package.json"),
|
|
JSON.stringify(
|
|
{ name: "fixture", scripts: scriptsRunning(guards) },
|
|
null,
|
|
2,
|
|
),
|
|
);
|
|
mkdirSync(path.join(dir, "scripts", "lib"), { recursive: true });
|
|
for (const rel of [
|
|
"verify-format-coverage.mjs",
|
|
path.join("lib", "npm-scripts.mjs"),
|
|
])
|
|
cpSync(path.join(scriptsDir, rel), path.join(dir, "scripts", rel));
|
|
execFileSync("git", ["init", "-q"], { cwd: dir });
|
|
execFileSync("git", ["add", "-A"], { cwd: dir });
|
|
|
|
const r = spawnSync(
|
|
process.execPath,
|
|
[path.join(dir, "scripts", "verify-format-coverage.mjs")],
|
|
{ cwd: dir, encoding: "utf8" },
|
|
);
|
|
return { status: r.status, out: `${r.stdout}${r.stderr}` };
|
|
} finally {
|
|
rmSync(dir, { recursive: true, force: true });
|
|
}
|
|
}
|
|
|
|
const ALL_SIBLINGS = [
|
|
"verify:typecheck-coverage",
|
|
"verify:dep-lockstep",
|
|
"verify:skills",
|
|
];
|
|
|
|
for (const dropped of ALL_SIBLINGS) {
|
|
test(`vouch: fails when \`${dropped}\` is dropped from validate`, () => {
|
|
const { status, out } = runWithGuards(
|
|
ALL_SIBLINGS.filter((g) => g !== dropped),
|
|
);
|
|
assert.equal(status, 1, out);
|
|
assert.match(out, new RegExp("no longer runs `" + dropped + "`"));
|
|
});
|
|
}
|
|
|
|
test("vouch: passes when every sibling is still wired", () => {
|
|
// The run still fails afterwards — the fixture has no client manifests to
|
|
// harvest globs from — so assert on the *reason*, not the exit status: no
|
|
// sibling may be reported missing.
|
|
const { out } = runWithGuards(ALL_SIBLINGS);
|
|
assert.doesNotMatch(out, /no longer runs/);
|
|
});
|