CI has no lockfile and cannot fail on missing scripts; release skips tests

Aberta
  • Algo errado?
#33 0 comentários 0 reações 0 responsáveis Ver no GitHub

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
52/100
Tipo de issue
Funcionalidade
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
eslint, github-actions, javascript, node.js
Domínio
build-system, ci-cd, release, tooling

Direção de pesquisa

Start with .github/workflows/ci.yml, .github/workflows/release.yml, and package.json; read the workflow definitions and package scripts, then run npm test and npm run lint. Check each suggested fix against the acceptance criteria, including reproducible installs and preventing releases from failing commits. Done when the CI and release workflows enforce the listed checks and the three acceptance criteria pass.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

severity: medium tech-debt

Summary

The CI and release workflows have several gaps that make builds non-reproducible and let a release go out from a commit that fails tests.

Where

  • .github/workflows/ci.yml:9-19
  • .github/workflows/release.yml:3-6, .github/workflows/release.yml:33-37
  • package.json:4, package.json:7-11

Details

- run: npm install
- run: npm run lint --if-present
- run: npm test --if-present -- --ci
  • No lockfile is committed and CI uses npm install, so every run resolves fresh versions inside the caret ranges, for direct and transitive packages.
  • --if-present turns a deleted or renamed script into a green step.
  • npm run format (prettier --check .) exists but CI never runs it.
  • There is no coverage script, although coverage/ is already in .gitignore.
  • ci.yml has no permissions: block, so its token scope depends on the repository default.
  • release.yml publishes on any v* tag without running lint or tests.
  • The fallback release body is built as "# Release ${TAG}\n\nSee ..." and printed with echo, so the published body contains literal \n\n. The GITHUB_OUTPUT heredoc uses a fixed EOF delimiter, which breaks if the notes contain a line EOF.
  • "lint": "eslint . --ext .js" uses a legacy flag; the flat config already scopes files.
  • package.json version is 0.0.0 while v0.1.0 is released.

Suggested fix

  • Commit package-lock.json, switch to npm ci, add cache: npm to setup-node
  • Drop --if-present
  • Add npm run format to CI
  • Add "coverage": "jest --coverage" with collectCoverageFrom: ["js/**/*.js"] and print the summary in CI
  • Add top-level permissions: contents: read to ci.yml
  • Make the release job depend on a test job
  • Use printf and a random heredoc delimiter in release.yml
  • Drop --ext .js; set the package version or state that it is unused

Acceptance criteria

  • Two CI runs on the same commit install the same dependency tree
  • Removing the test script fails CI
  • A tag on a commit with failing tests does not publish a release

Getting started

  • Relevant files: .github/workflows/ci.yml, .github/workflows/release.yml, package.json
  • How to run tests: npm install, then npm test and npm run lint
  • Related docs: docs/ARCHITECTURE.md, .github/CONTRIBUTING.md

Filed by repo-audit/full-audit at 8a2c86c. Severity: medium. Effort: S. audit-key: quality|.github/workflows/ci.yml|jobs.test

Linguagem predominante
JavaScript
Estrelas
4
Forks
2
Nenhum PR com merge em 30d

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de TMHSDigital/Static_Chess

Todas as issues de TMHSDigital/Static_Chess

Issues semelhantes

Mais issues de JavaScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.