mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
7ee5bbc64d
* fix(build): spawn npx.cmd through a shell in the electron better-sqlite3 rebuild Node's CVE-2024-27980 hardening makes spawnSync of .cmd/.bat shims fail with status null unless shell:true — the v3.8.47 tag build died on the Windows job with 'better-sqlite3 rebuild against electron 43.1.0 failed (exit null)'. Extracted the spawn plan into electronRebuildPlan.mjs (pure, import-safe) with a regression test; args are fixed literals, no untrusted input reaches the shell. * fix(build): ship head-response-guard.cjs in the npm tarball (#7065) The prepublish prune allowlist (pack-artifact-policy.ts) lacked head-response-guard.cjs, so assembleStandalone copied it and the prune deleted it — every boot of the published 3.8.47 crashed with ERR_MODULE_NOT_FOUND (3rd occurrence of this class; tls-options/3.8.41). Also added to PACK_ARTIFACT_REQUIRED_PATHS so check:pack-artifact fails loudly, plus a closure test that derives every server-ws.mjs sibling import and asserts both lists cover it. * fix(ci): zero the Sonar quality-gate findings on new code - ci.yml sonarqube job: download the coverage artifact into coverage/ so lcov.info lands where sonar.javascript.lcov.reportPaths points — the upload strips the common coverage/ prefix, so 'path: .' left new-code coverage at 0% on every scan - kiro auto-import: await the async isCloudEnabled() gate (S6544 — a bare truthiness check on the Promise made syncToCloud run even with cloud sync disabled) - stream.ts: real JSON fallback in the reasoning-split clone (S3923 — both ternary branches called structuredClone, the promised fallback was dead) - codex executor: handle the async reader.cancel() rejection (S4822) - deterministic localeCompare sorts (S2871 x2) - classify-pr-changes.mjs: confine the argv list file to the workspace (jssecurity:S8707 path-traversal guard) + behavioral tests - Dockerfile: rebuild better-sqlite3 with npm's bundled node-gyp instead of npx --yes (docker:S6505 — no on-demand registry install) * chore(ci): make the Sonar quality gate informational (wait=false) The org's SonarCloud FREE plan cannot associate a custom quality gate — only the built-in Sonar way (80% new coverage) applies, which no full-cycle release PR can realistically meet. The scan still uploads (dashboard, PR decoration); the CI job just no longer fails on the gate. A tuned 'OmniRoute way' gate (coverage >=60, duplication <=5) is already configured in the org for the day the plan is upgraded — re-enable wait=true then. * chore(release): v3.8.48 hotfix bump + changelog (npm 3.8.47 unbootable, #7065) * test: align pack-artifact + dockerfile guards to the corrected contracts pack-artifact-policy.test.ts encoded the pre-#7065 REQUIRED list (without head-response-guard.cjs) and dockerfile-better-sqlite3-node-gyp-6700.test.ts asserted the npx invocation the Sonar fix replaced with npm's bundled node-gyp — both now assert the corrected behavior.
41 lines
1.9 KiB
TypeScript
41 lines
1.9 KiB
TypeScript
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import {
|
|
APP_STAGING_ALLOWED_EXACT_PATHS,
|
|
PACK_ARTIFACT_REQUIRED_PATHS,
|
|
} from "../../scripts/build/pack-artifact-policy.ts";
|
|
|
|
// #7065 (3rd occurrence of this class — tls-options/3.8.41, head-response-guard/3.8.47):
|
|
// dist/server-ws.mjs imports sibling files that assembleStandalone copies into dist/,
|
|
// but the prepublish prune deletes anything not in APP_STAGING_ALLOWED_EXACT_PATHS and
|
|
// check:pack-artifact only fails for entries in PACK_ARTIFACT_REQUIRED_PATHS. Any local
|
|
// import missing from EITHER list ships a tarball that crashes on boot. This test derives
|
|
// the closure from the source of truth (the wrapper's own imports) so the class is closed.
|
|
|
|
const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
|
|
const WRAPPER = path.join(ROOT, "scripts", "dev", "standalone-server-ws.mjs");
|
|
|
|
function localImports(): string[] {
|
|
const src = fs.readFileSync(WRAPPER, "utf8");
|
|
return [...src.matchAll(/from\s+"\.\/([^"]+)"/g)].map((m) => m[1]);
|
|
}
|
|
|
|
test("every server-ws.mjs local import survives the prepublish prune (allowlist)", () => {
|
|
const missing = localImports().filter((f) => !APP_STAGING_ALLOWED_EXACT_PATHS.includes(f));
|
|
assert.deepEqual(missing, [], `add to APP_STAGING_ALLOWED_EXACT_PATHS: ${missing.join(", ")}`);
|
|
});
|
|
|
|
test("every server-ws.mjs local import is enforced by check:pack-artifact (required)", () => {
|
|
const missing = localImports().filter(
|
|
(f) => !PACK_ARTIFACT_REQUIRED_PATHS.includes(`dist/${f}`)
|
|
);
|
|
assert.deepEqual(missing, [], `add dist/<file> to PACK_ARTIFACT_REQUIRED_PATHS: ${missing.join(", ")}`);
|
|
});
|
|
|
|
test("sanity: the wrapper actually has local imports (regex not silently broken)", () => {
|
|
assert.ok(localImports().length >= 5, `parsed only ${localImports().length} imports`);
|
|
});
|