Add CI workflow and node --test suite#12
Open
jgamblin wants to merge 4 commits into
Open
Conversation
Adds a GitHub Actions CI workflow (typecheck, build, test) on the supported Node 24 range, and converts the existing dist smoke script into a proper `node --test` suite covering schema validation, all six business rules, and the warning registry. - .github/workflows/ci.yml: run on push/PR to dev and main - test/validate.test.mjs: record + published/rejected CNA container cases - test/warnings.test.mjs: WarningRegistry object, positional, and error paths - package.json: `test` now runs typecheck + build + node --test; add `test:unit` - README: document `npm test` and `npm run test:unit` Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Applies fixes from the pre-PR review panel before this reaches the
public repo:
mustFix:
- Scope the test runner to the intended suite so scripts/test-local.mjs
is no longer swept in by Node's default `test-*` discovery.
- Use double quotes in the glob so `npm test` works under cmd.exe on
Windows dev machines (single quotes are literal there).
- Compute the datePublic future date at runtime instead of hard-coding
a calendar date, removing the wall-clock time bomb in the tests.
shouldFix:
- WarningRegistry tests: per-test isolated registry (beforeEach) and
delta assertions, removing inter-test ordering coupling.
- CI: drop the redundant explicit build step (npm ci already builds via
`prepare`); SHA-pin actions/checkout and actions/setup-node to v4.4.0;
set persist-credentials: false on checkout.
- Resolve test fixtures relative to import.meta.url (cwd-independent).
- Add coverage for the schema-only methods, the custom-schema-path
constructor, and defensive/malformed inputs ({}, [], bad state, null).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Make the custom-schema-path test non-vacuous: validate the same record
against a divergent (CNA-container) schema so a fallback-to-default
regression is observable (accepted under record schema, rejected under
CNA schema).
- Consolidate the {}/[] defensive cases into one test that documents they
share the missing-cveMetadata pre-check, instead of implying
array-specific handling.
- CI hardening: add a guard step that fails when no test files match (node
--test exits 0 on a zero-match glob); add job timeout-minutes: 15; add a
concurrency group with cancel-in-progress; note the intentional split
between CI's granular steps and the aggregate `npm test`.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Scope concurrency cancel-in-progress to non-protected refs so per-commit CI on dev/main always completes (avoids canceling an earlier commit's run). - Guard the test-discovery find with 2>/dev/null and `|| true` so a missing test/ directory reaches the explicit check and emits the intended ::error:: annotation instead of aborting at the assignment. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds continuous integration and an automated test suite. Today
npm testonly runstsc --noEmit, and the sole functional coverage is a smoke script (scripts/test-local.mjs) that must be run manually against a prior build; there is no CI.This PR is CI + tests only — no production (
src/) changes.CI (
.github/workflows/ci.yml)dev/mainacross the supported Node range (24.13.0and latest24.x, matchingengines).npm cibuilds the package via thepreparehook, so the build runs once; steps are thentypecheckand the tests, for clear per-step attribution.permissions: contents: read, actions SHA-pinned tov4.4.0,persist-credentials: false,timeout-minutes, and aconcurrencygroup (cancellation scoped to non-protected refs so per-commit CI ondev/mainstill completes).node --testexits 0 on a zero-match glob (a renamed/moved test dir would otherwise pass green silently).Tests (
test/*.test.mjs,node --test, no new dependencies)validate.test.mjs— valid records; schema failures; all six business rules (unique English entry, non-empty description, futuredatePublic, cna + adp timeline datetimes, PURL); published/rejected CNA container paths; the schema-only methods (validatePublishedCveCnaContainerSchema/validateRejectedCveCnaContainerSchema); the custom-schema-path constructor; and defensive/malformed inputs ({},[], unknown state,null).warnings.test.mjs—WarningRegistryobject and positional-argument forms, serialization, cross-instance append, and the invalid-warning error path; each test uses an isolated registry file (no inter-test ordering coupling).datePublicdates are computed at runtime (not hard-coded), so the tests can't silently flip on a calendar date.node --test "test/**/*.test.mjs") sonpm testworks under both POSIX shells and Windowscmd.exe, and is scoped so it does not also re-runscripts/test-local.mjs.package.json / README
testnow runstypecheck && build && node --test "test/**/*.test.mjs"; addstest:unitfor running against an existingdist/. The existingtest:localsmoke script is unchanged and still runs standalone.All 26 tests pass locally (
npm test), and the existing smoke test still passes.Notes
🤖 Generated with Claude Code