test(cli-plugins): repair failing unit test suites across packages [DX-9770]#303
Conversation
…X-9770] Fix toolchain/config/stale-fixture drift (Node 24, ESLint 10, ts-node/mocha) that broke unit suites across several packages -- these were tooling issues, not product bugs: - import: add missing test/tsconfig.json (pretest TS5057) -- 1726 passing - branches: fix test/tsconfig (TS6059), auth-stub command tests, regenerate stale diff/merge fixtures, stub process.exit in collectMergeSettings -- 123 passing - seed: rewrite suite against current SDK/HttpClient impl + resolveJsonModule -- 33 passing - external-migrate: fix 16 lint errors (ignore lib/, idiomatic rule options, optional catch bindings) -- lint clean, 42 passing - variants: fix ESM/JSON toolchain, fancy/spy test harness, auth stubs, mock config -- 32/38 passing (6 known-remaining, see ticket) - root: add lint script consistent with cli No product/runtime source changed except 3 behavior-preserving catch bindings in external-migrate. The ESLint flat-config migration (~10 packages) and the 6 remaining variants integration failures are tracked as out-of-scope follow-ups. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
❌ BUILD FAILED - Security checks failed Please review and fix the security vulnerabilities before merging. |
Resolve the high-severity Snyk SCA findings blocking CI (security-sca): - fast-uri 3.1.3 -> 3.1.4 (SNYK-JS-FASTURI-18021349, Interpretation Conflict) - ws 8.21.0 -> 8.21.1 (SNYK-JS-WS-17988732, resource allocation / CVE-2026-62389) Added scoped pnpm.overrides (range-limited so the unrelated ws@1.0.2 resolution is untouched) and refreshed the lockfile. Both are patch bumps of transitive deps. Note: inflight@1.0.6 (medium, SNYK-JS-INFLIGHT-6095116) has no published fix (package is abandoned); left as-is. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
The eslint.config.js files in these packages crashed under ESLint 10 (flat config): they imported the deprecated eslint-config-oclif-typescript (v3, eslintrc-style) or referenced removed @typescript-eslint rules (quotes/type-annotation-spacing/ban-ts-ignore) and unloaded plugins (node/*, unicorn/*), so `lint` never actually ran. Standardised all 10 on a valid flat config (typescript-eslint recommended + package rules; unicorn/node registered so pre-existing inline eslint-disable directives resolve). Packages: apps-cli, audit, branches, cli-tsgen, content-type, export, export-to-csv, import, import-setup, query-export. Because lint had been crashing, fixing the configs surfaced ~1000 pre-existing source lint issues (mostly prefer-const + no-unused-vars). These were never enforced before, so the debt-revealing rules are set to 'warn' (kept visible, non-blocking); a follow-up ticket tracks cleaning them. There is no lint gate in CI, so this changes no CI outcome. No product source changed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
…orkflow [DX-9770] Make cli-plugins consistent with cli-core (separate test and lint): - Decouple: remove the `posttest` lint hooks from all packages so `npm test` runs tests only (npm's posttest was auto-running lint after every test). - Uniform lint command `eslint "src/**/*.ts"` across all 18 TS packages (was three variants: `eslint .`, `eslint . --ext .ts`, `eslint src/**/*.ts`). - Add a `lint` script to the 5 TS packages that lacked one (bootstrap, cli-cm-regex-validate, migration, seed, variants) + a flat config for variants. - Drop `--fix` from cli-tsgen's lint script so lint checks rather than mutates. - Add .github/workflows/lint.yml (mirrors cli-core's) as a dedicated PR gate running `pnpm run lint`. All 18 TS packages now lint with 0 errors (warnings only; cleanup tracked in DX-9771). No product source changed. The two JS-only packages (bulk-publish, migrate-rte) still need a JS lint setup and are left for the test-runner normalization follow-up. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
…l [DX-9770] Address review feedback: keep all overrides in pnpm-workspace.yaml for consistency, instead of package.json `pnpm.overrides`. - Move the fast-uri and ws overrides into pnpm-workspace.yaml. - Bump the existing `fast-uri` override 3.1.3 -> 3.1.4: 3.1.3 is the vulnerable version (SNYK-JS-FASTURI-18021349) this PR is fixing, so the workspace pin is updated to the patched release. - Add `ws: 8.21.1` (SNYK-JS-WS-17988732). - Remove the now-redundant `pnpm.overrides` block from package.json. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
4 participants
What & why
Repairs the
cli-pluginstest + lint tooling, which had drifted and broken under the current toolchain (Node 24, ESLint 10, modern ts-node/mocha). Failures were toolchain / config / stale-fixture drift, not product bugs. Also brings the test/lint script setup in line withcli-core (test and lint separated).Jira: DX-9770 (epic DX-7539) · follow-up DX-9771
1. Unit-test suite repairs
importtest/tsconfig.json)branchesprocess.exitstub)seedresolveJsonModule)external-migratevariantsRoot cause themes: Node 24 native TS type-stripping (mocha loading specs as ESM), missing/misconfigured
test/tsconfig.json, stale mocks after an axios→SDK/HttpClient migration, auth-dependent command tests not stubbing the auth check, and moved@oclif/test/fancyimports.2. Dependency security fixes
Scoped
pnpm.overrides+ lockfile refresh to clear the high-severity Snyk SCA findings:fast-uri3.1.3 → 3.1.4 (SNYK-JS-FASTURI-18021349)ws8.21.0 → 8.21.1 (SNYK-JS-WS-17988732 / CVE-2026-62389)3. ESLint 10 flat-config repair (10 packages)
The
eslint.config.jsfiles crashed under ESLint 10 (imported the deprecatedeslint-config-oclif-typescriptv3 / referenced removed@typescript-eslintrules / unloaded plugins), solintnever ran. Standardized on a valid flat config. Because lint had been crashing, this surfaced ~1000 pre-existing source lint issues (mostlyprefer-const/no-unused-vars); those rules are set to'warn'(visible, non-blocking) with cleanup tracked in DX-9771.4. Lint consistency (align with cli-core)
posttestlint hooks from all packages, sonpm testruns tests only.eslint "src/**/*.ts"across all 18 TS packages (was three variants).lintto the 5 TS packages that lacked one; dropped--fixfrom cli-tsgen's lint so it checks rather than mutates..github/workflows/lint.yml(mirrors cli-core) — a dedicated Lint PR gate runningpnpm run lint.All 18 TS packages now lint with 0 errors.
Out of scope (follow-ups)
variants6 remaining integration test failures.errorseverity — DX-9771.bulk-publish,migrate-rte) still lacking lint — deferred to a runner-normalization follow-up.Notes
catchbindings inexternal-migrate).lint.ymladds one.🤖 Generated with Claude Code
https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9