CI has no lockfile and cannot fail on missing scripts; release skips tests

未关闭
  • 哪里不对？
#33 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
52/100
Issue 类型
功能
描述清晰度
描述清楚
活跃度
活跃
技术栈
eslint, github-actions, javascript, node.js
领域
build-system, ci-cd, release, tooling

调研方向

Start with .github/workflows/ci.yml, .github/workflows/release.yml, and package.json; read the workflow definitions and package scripts, then run npm test and npm run lint. Check each suggested fix against the acceptance criteria, including reproducible installs and preventing releases from failing commits. Done when the CI and release workflows enforce the listed checks and the three acceptance criteria pass.

由索引模型根据 Issue 内容生成。

描述

severity: medium tech-debt

Summary

The CI and release workflows have several gaps that make builds non-reproducible and let a release go out from a commit that fails tests.

Where

  • .github/workflows/ci.yml:9-19
  • .github/workflows/release.yml:3-6, .github/workflows/release.yml:33-37
  • package.json:4, package.json:7-11

Details

- run: npm install
- run: npm run lint --if-present
- run: npm test --if-present -- --ci
  • No lockfile is committed and CI uses npm install, so every run resolves fresh versions inside the caret ranges, for direct and transitive packages.
  • --if-present turns a deleted or renamed script into a green step.
  • npm run format (prettier --check .) exists but CI never runs it.
  • There is no coverage script, although coverage/ is already in .gitignore.
  • ci.yml has no permissions: block, so its token scope depends on the repository default.
  • release.yml publishes on any v* tag without running lint or tests.
  • The fallback release body is built as "# Release ${TAG}\n\nSee ..." and printed with echo, so the published body contains literal \n\n. The GITHUB_OUTPUT heredoc uses a fixed EOF delimiter, which breaks if the notes contain a line EOF.
  • "lint": "eslint . --ext .js" uses a legacy flag; the flat config already scopes files.
  • package.json version is 0.0.0 while v0.1.0 is released.

Suggested fix

  • Commit package-lock.json, switch to npm ci, add cache: npm to setup-node
  • Drop --if-present
  • Add npm run format to CI
  • Add "coverage": "jest --coverage" with collectCoverageFrom: ["js/**/*.js"] and print the summary in CI
  • Add top-level permissions: contents: read to ci.yml
  • Make the release job depend on a test job
  • Use printf and a random heredoc delimiter in release.yml
  • Drop --ext .js; set the package version or state that it is unused

Acceptance criteria

  • Two CI runs on the same commit install the same dependency tree
  • Removing the test script fails CI
  • A tag on a commit with failing tests does not publish a release

Getting started

  • Relevant files: .github/workflows/ci.yml, .github/workflows/release.yml, package.json
  • How to run tests: npm install, then npm test and npm run lint
  • Related docs: docs/ARCHITECTURE.md, .github/CONTRIBUTING.md

Filed by repo-audit/full-audit at 8a2c86c. Severity: medium. Effort: S. audit-key: quality|.github/workflows/ci.yml|jobs.test

主要语言
JavaScript
星标
4
派生
2
30 天内没有已合并 PR

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

TMHSDigital/Static_Chess 的其他 Issue

查看 TMHSDigital/Static_Chess 的全部 Issue

相似的 Issue

更多 JavaScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。