CI has no lockfile and cannot fail on missing scripts; release skips tests

Ouverte
  • Quelque chose ne va pas ?
#33 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
52/100
Type d'issue
Fonctionnalité
Clarté
Clairement spécifiée
Activité
Active
Stack technique
eslint, github-actions, javascript, node.js
Domaine
build-system, ci-cd, release, tooling

Piste de recherche

Start with .github/workflows/ci.yml, .github/workflows/release.yml, and package.json; read the workflow definitions and package scripts, then run npm test and npm run lint. Check each suggested fix against the acceptance criteria, including reproducible installs and preventing releases from failing commits. Done when the CI and release workflows enforce the listed checks and the three acceptance criteria pass.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

severity: medium tech-debt

Summary

The CI and release workflows have several gaps that make builds non-reproducible and let a release go out from a commit that fails tests.

Where

  • .github/workflows/ci.yml:9-19
  • .github/workflows/release.yml:3-6, .github/workflows/release.yml:33-37
  • package.json:4, package.json:7-11

Details

- run: npm install
- run: npm run lint --if-present
- run: npm test --if-present -- --ci
  • No lockfile is committed and CI uses npm install, so every run resolves fresh versions inside the caret ranges, for direct and transitive packages.
  • --if-present turns a deleted or renamed script into a green step.
  • npm run format (prettier --check .) exists but CI never runs it.
  • There is no coverage script, although coverage/ is already in .gitignore.
  • ci.yml has no permissions: block, so its token scope depends on the repository default.
  • release.yml publishes on any v* tag without running lint or tests.
  • The fallback release body is built as "# Release ${TAG}\n\nSee ..." and printed with echo, so the published body contains literal \n\n. The GITHUB_OUTPUT heredoc uses a fixed EOF delimiter, which breaks if the notes contain a line EOF.
  • "lint": "eslint . --ext .js" uses a legacy flag; the flat config already scopes files.
  • package.json version is 0.0.0 while v0.1.0 is released.

Suggested fix

  • Commit package-lock.json, switch to npm ci, add cache: npm to setup-node
  • Drop --if-present
  • Add npm run format to CI
  • Add "coverage": "jest --coverage" with collectCoverageFrom: ["js/**/*.js"] and print the summary in CI
  • Add top-level permissions: contents: read to ci.yml
  • Make the release job depend on a test job
  • Use printf and a random heredoc delimiter in release.yml
  • Drop --ext .js; set the package version or state that it is unused

Acceptance criteria

  • Two CI runs on the same commit install the same dependency tree
  • Removing the test script fails CI
  • A tag on a commit with failing tests does not publish a release

Getting started

  • Relevant files: .github/workflows/ci.yml, .github/workflows/release.yml, package.json
  • How to run tests: npm install, then npm test and npm run lint
  • Related docs: docs/ARCHITECTURE.md, .github/CONTRIBUTING.md

Filed by repo-audit/full-audit at 8a2c86c. Severity: medium. Effort: S. audit-key: quality|.github/workflows/ci.yml|jobs.test

Langage dominant
JavaScript
Étoiles
4
Forks
2
Aucune PR mergée en 30 j

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de TMHSDigital/Static_Chess

Toutes les issues de TMHSDigital/Static_Chess

Issues similaires

Plus d'issues JavaScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.