From 1e8e88cb70df67338aab9b2c8ea2568e12018dd0 Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Sun, 9 Aug 2026 00:02:12 +0900 Subject: [PATCH 1/2] test(ci): bind the Windows shard assertion to an executable command (#1185) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The assertion that the Windows leg shards the suite used `.includes()` on the step's `run` text, so any occurrence of the command anywhere in the script satisfied it — including inside an `echo`, or in a comment. A Windows job that printed the command instead of running it kept the suite green. `hasExactShellCommand` splits the script into lines, drops blanks and comments, and requires the exact command as a whole line. The negative assertion against `echo ` pins that behaviour so a future loosening back to substring matching fails here rather than silently. Republished from #1185 by luvs01, whose branch was 324 commits behind dev. Rebased onto 14e948525 with no conflicts; authorship preserved below. Co-authored-by: luvs01 --- tests/ci-workflows.test.ts | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/tests/ci-workflows.test.ts b/tests/ci-workflows.test.ts index fa6ca5cc7..6d71b8ecf 100644 --- a/tests/ci-workflows.test.ts +++ b/tests/ci-workflows.test.ts @@ -39,6 +39,15 @@ function count(text: string, fragment: string): number { return text.split(fragment).length - 1; } +/** Match an executable shell line, not a fragment that could appear in echo or a comment. */ +function hasExactShellCommand(run: string | undefined, expected: string): boolean { + return (run ?? "") + .split(/\r?\n/) + .map(line => line.trim()) + .filter(line => line.length > 0 && !line.startsWith("#")) + .includes(expected); +} + function expectSecureLinuxKeyringBootstrap(workflow: string): void { const smokeStep = workflow .split("- name: OS keyring create/read/delete smoke")[1] @@ -164,7 +173,9 @@ describe("GitHub Actions hardening", () => { // the runner's disk and the suite passes against a tree that no longer // exists in git. const winSteps = (ci.jobs?.["platform-windows"] as { steps?: { if?: string; run?: string }[] })?.steps ?? []; - expect(winSteps.some(step => step.run?.includes(`--shard=\${{ matrix.shard }}/${windowsShards.length}`))).toBe(true); + const windowsTestCommand = `bun test --isolate tests --shard=\${{ matrix.shard }}/${windowsShards.length}`; + expect(hasExactShellCommand(`echo ${windowsTestCommand}`, windowsTestCommand)).toBe(false); + expect(winSteps.some(step => hasExactShellCommand(step.run, windowsTestCommand))).toBe(true); expect(winSteps.some(step => step.if === "runner.environment == 'self-hosted'" && step.run?.includes("git clean -xffd"))).toBe(true); From e239b9652ff60dd299bdaa46a958875eeae517d1 Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Sun, 9 Aug 2026 00:02:39 +0900 Subject: [PATCH 2/2] test(ci): require the Windows test step to be unconditional MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Maintainer-added coverage for the #1185 republish. Binding the assertion to an executable line closes the echo/comment hole, but a step carrying the exact command still runs nothing under `if: false` — the suite would stay green against a Windows leg that never tests. Ablated both ways against current dev: replacing the run line with `echo ` fails the contributor's assertion, and adding `if: false` to that same step fails this one. Neither mutation is caught by dev today. --- tests/ci-workflows.test.ts | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/tests/ci-workflows.test.ts b/tests/ci-workflows.test.ts index 6d71b8ecf..ef2dc02a2 100644 --- a/tests/ci-workflows.test.ts +++ b/tests/ci-workflows.test.ts @@ -175,7 +175,13 @@ describe("GitHub Actions hardening", () => { const winSteps = (ci.jobs?.["platform-windows"] as { steps?: { if?: string; run?: string }[] })?.steps ?? []; const windowsTestCommand = `bun test --isolate tests --shard=\${{ matrix.shard }}/${windowsShards.length}`; expect(hasExactShellCommand(`echo ${windowsTestCommand}`, windowsTestCommand)).toBe(false); - expect(winSteps.some(step => hasExactShellCommand(step.run, windowsTestCommand))).toBe(true); + // Binding the assertion to an executable line is only half the guarantee: a + // step carrying the exact command still runs nothing under `if: false`, and + // the suite would stay green against a Windows leg that never tests. Require + // the matching step to be unconditional. + const windowsTestSteps = winSteps.filter(step => hasExactShellCommand(step.run, windowsTestCommand)); + expect(windowsTestSteps.length).toBeGreaterThan(0); + expect(windowsTestSteps.every(step => step.if === undefined)).toBe(true); expect(winSteps.some(step => step.if === "runner.environment == 'self-hosted'" && step.run?.includes("git clean -xffd"))).toBe(true);