cliffhall
398d074ad9
chore(scripts): scan only executable positions, and match on the expression prefix ( #2146 )
...
Copilot, second review — both findings were real:
- A `${{ … }}` body can itself contain braces, so the `[^}]*\}\}` arm added in
the previous round stopped at the first `}` and missed
`smoke:web:${{ format('{0}', matrix.browser) }}` — the very case it was
added for. It now keys off the `${{` prefix, which nesting cannot defeat.
- Scanning every non-comment line made ordinary metadata a finding:
`name: Explain why smoke:web:firefox stays local` executes nothing and was
reported as an engine invocation, contradicting the header's "what it
forbids, and nothing more". The scan now walks executable positions only —
`run:` scalars (inline and block) and `env:`/`with:` values — via an
exported `extractExecutableRegions`, hand-rolled because `test:scripts` is
dependency-free by design. The narrowing is a stated limit, not a hidden
one: an execution vector outside those three positions is not seen.
Verified by injecting a nested-brace SMOKE_BROWSER expression into the real
main.yml — the suite fails, and goes green again when removed.
Signed-off-by: Cliff Hall <cliff@futurescale.com>
Signed-off-by: cliffhall <cliff@futurescale.com>
2026-08-27 00:35:47 -04:00
..
announced-child.mjs
chore(scripts): rename the local pre-push gate off ci, and guard it out of CI ( #2146 )
2026-08-26 23:56:34 -04:00
announced-child.test.mjs
chore(scripts): rename the local pre-push gate off ci, and guard it out of CI ( #2146 )
2026-08-26 23:56:34 -04:00
child-cleanup.mjs
fix(scripts): await the pack:verify web child's exit before removing its work dir ( #1895 )
2026-08-01 19:50:00 -04:00
child-cleanup.test.mjs
fix(scripts): await the pack:verify web child's exit before removing its work dir ( #1895 )
2026-08-01 19:50:00 -04:00
deep-link-connect.mjs
chore(web): connected-flow smoke for the Tools, Resources and Prompts tabs
2026-08-26 23:09:44 -04:00
deep-link-connect.test.mjs
chore(web): connected-flow smoke for the Tools, Resources and Prompts tabs
2026-08-26 23:09:44 -04:00
ensure-test-servers.mjs
docs(scripts): correct the deleted-source caveat — it is silent, not loud
2026-08-25 01:37:40 -04:00
ensure-test-servers.test.mjs
fix(scripts): pin the tsbuildinfo inside build/, assert on cache hits
2026-08-25 01:11:10 -04:00
headless-browser.mjs
fix(smoke): assert the requested engine is the one launched; fix the remedy
2026-08-26 09:33:21 -04:00
headless-browser.test.mjs
fix(smoke): assert the requested engine is the one launched; fix the remedy
2026-08-26 09:33:21 -04:00
mcp-app-flow.mjs
chore(web): connected-flow smoke for the Tools, Resources and Prompts tabs
2026-08-26 23:09:44 -04:00
mcp-app-flow.test.mjs
Merge branch 'v2/main' into v2/chore/2003-pack-verify-app-render
2026-08-24 09:05:53 -04:00
npm-scripts.mjs
test(cli,tui): typecheck the __tests__ dirs ( #1791 ) ( #1799 )
2026-07-27 12:05:35 -04:00
npm-scripts.test.mjs
test(cli,tui): typecheck the __tests__ dirs ( #1791 ) ( #1799 )
2026-07-27 12:05:35 -04:00
prod-web-server.mjs
test(smoke): cover loadBrowser's failure branches; fix a stale helper comment
2026-08-25 22:42:06 -04:00
prod-web-server.test.mjs
fix(smoke): pin the teardown ordering, and correct a docblock the test refuted
2026-08-11 15:17:56 -04:00
pty.mjs
fix(scripts): address Copilot review round 2 on #2147
2026-08-26 21:36:40 -04:00
pty.test.mjs
fix(scripts): address Copilot review round 2 on #2147
2026-08-26 21:36:40 -04:00
render-smoke.mjs
fix(scripts): make the test stubs drain, and the raw-mode guard testable ( #2147 )
2026-08-26 22:13:35 -04:00
render-smoke.test.mjs
fix(scripts): make the test stubs drain, and the raw-mode guard testable ( #2147 )
2026-08-26 22:13:35 -04:00
resolve-node-bin.mjs
fix(scripts): keep the resolver local, complete the cmd.exe quoting
2026-08-17 00:18:40 -04:00
resolve-node-bin.test.mjs
fix(scripts): keep the resolver local, complete the cmd.exe quoting
2026-08-17 00:18:40 -04:00
tsc-program.mjs
fix(scripts): validate the bin name and that its file exists
2026-08-16 23:43:24 -04:00
tsc-program.test.mjs
chore(scripts): compare only the copies a program actually met
2026-08-16 12:35:38 -04:00
win-shell-args.mjs
fix(scripts): keep the resolver local, complete the cmd.exe quoting
2026-08-17 00:18:40 -04:00
win-shell-args.test.mjs
fix(scripts): keep the resolver local, complete the cmd.exe quoting
2026-08-17 00:18:40 -04:00
workflow-gate.mjs
chore(scripts): scan only executable positions, and match on the expression prefix ( #2146 )
2026-08-27 00:35:47 -04:00
workflow-gate.test.mjs
chore(scripts): scan only executable positions, and match on the expression prefix ( #2146 )
2026-08-27 00:35:47 -04:00