7dd9f47ca2Adds npm audit fix (root + every client) as the first sub-step of the release skill's bump step, before npm version, so a release is never gated on remembering to check separately. Never --force; anything audit fix can't resolve is left to the dependabot-alert pipeline (#2229) or a follow-up issue. Disables Dependabot npm version updates in dependabot.yml (a version-update PR carries no issue and no board card) and replaces them with a monthly scheduled sweep that runs npm outdated across the root install and every client, filing or updating one idempotent tracking issue instead of an auto-generated PR. Closes #2231 Part of #2229 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017N9ha27Qg6LHpBQP7G7zPY Signed-off-by: cliffhall <cliff@futurescale.com>
61 lines
2 KiB
JavaScript
61 lines
2 KiB
JavaScript
// Unit tests for the pure parsing/formatting halves of dependency-refresh.mjs
|
|
// (#2229). The impure half (`main()`, which shells out to `npm` and `gh`) is
|
|
// exercised only via `workflow_dispatch` in CI, per the same split
|
|
// `verify-skills.mjs` uses. Run via `npm run test:scripts`.
|
|
|
|
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import {
|
|
buildIssueBody,
|
|
parseOutdated,
|
|
ISSUE_MARKER,
|
|
} from "./dependency-refresh.mjs";
|
|
|
|
test("parseOutdated returns [] for empty npm-outdated output", () => {
|
|
assert.deepEqual(parseOutdated(""), []);
|
|
assert.deepEqual(parseOutdated("{}"), []);
|
|
});
|
|
|
|
test("parseOutdated normalizes and sorts entries by name", () => {
|
|
const json = JSON.stringify({
|
|
zod: { current: "3.0.0", wanted: "3.1.0", latest: "4.0.0" },
|
|
ajv: { current: "8.0.0", wanted: "8.0.0", latest: "8.1.0" },
|
|
});
|
|
assert.deepEqual(parseOutdated(json), [
|
|
{ name: "ajv", current: "8.0.0", wanted: "8.0.0", latest: "8.1.0" },
|
|
{ name: "zod", current: "3.0.0", wanted: "3.1.0", latest: "4.0.0" },
|
|
]);
|
|
});
|
|
|
|
test("parseOutdated falls back when a field is missing", () => {
|
|
const json = JSON.stringify({ pkg: { current: "1.0.0" } });
|
|
assert.deepEqual(parseOutdated(json), [
|
|
{ name: "pkg", current: "1.0.0", wanted: "1.0.0", latest: "?" },
|
|
]);
|
|
});
|
|
|
|
test("buildIssueBody returns null when every install is up to date", () => {
|
|
assert.equal(
|
|
buildIssueBody([
|
|
{ label: "root", packages: [] },
|
|
{ label: "clients/web", packages: [] },
|
|
]),
|
|
null,
|
|
);
|
|
});
|
|
|
|
test("buildIssueBody starts with the idempotency marker and skips empty installs", () => {
|
|
const body = buildIssueBody([
|
|
{ label: "root", packages: [] },
|
|
{
|
|
label: "clients/web",
|
|
packages: [
|
|
{ name: "zod", current: "3.0.0", wanted: "3.1.0", latest: "4.0.0" },
|
|
],
|
|
},
|
|
]);
|
|
assert.ok(body.startsWith(ISSUE_MARKER));
|
|
assert.ok(body.includes("### `clients/web`"));
|
|
assert.ok(!body.includes("### `root`"));
|
|
assert.ok(body.includes("| `zod` | 3.0.0 | 3.1.0 | 4.0.0 |"));
|
|
});
|