James MaesandCodex
ce9afc6237
Refs #5. Preserve every configured rule and fail closed; verify both partitions with negative fixtures. All 13 files and a bounded 20-case race probe pass locally. Co-Authored-By: Codex (GPT-6) <noreply@openai.com> Signed-off-by: James Maes <jmaes@dmdbrands.com>
90 lines
3.9 KiB
YAML
90 lines
3.9 KiB
YAML
# K22-CODE-SH: check repository tooling before merges and releases.
|
|
name: scripts
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
workflow_call:
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
javascript:
|
|
name: javascript
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Set up Node
|
|
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
|
|
with:
|
|
node-version: "24"
|
|
- name: Install locked tools without lifecycle scripts
|
|
run: npm ci --ignore-scripts
|
|
- name: Lint and test review validation
|
|
run: |
|
|
npm run lint
|
|
npm test
|
|
- name: Verify dependency signatures
|
|
run: npm audit signatures
|
|
|
|
powershell:
|
|
name: powershell
|
|
runs-on: windows-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Install pinned analyzer and check scripts
|
|
shell: pwsh
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
Install-Module PSScriptAnalyzer -RequiredVersion 1.25.0 -Scope CurrentUser -Force
|
|
Import-Module PSScriptAnalyzer -RequiredVersion 1.25.0
|
|
# Negative fixtures prove neither partition can silently lose its rules.
|
|
$casingFixture = @(Invoke-ScriptAnalyzer -ScriptDefinition "get-content -literalpath 'fixture.txt'" -Settings ./PSScriptAnalyzerSettings.psd1 -IncludeRule PSUseCorrectCasing)
|
|
if('PSUseCorrectCasing' -notin $casingFixture.RuleName) { throw 'The casing pass did not detect incorrect casing.' }
|
|
$remainingFixture = @(Invoke-ScriptAnalyzer -ScriptDefinition "Write-Host 'fixture'" -Settings ./PSScriptAnalyzerSettings.psd1 -ExcludeRule PSUseCorrectCasing)
|
|
if('PSAvoidUsingWriteHost' -notin $remainingFixture.RuleName) { throw 'The remaining-rule pass did not detect Write-Host.' }
|
|
# Keep casing in its own pass: command metadata races other rules in 1.25.0.
|
|
# https://github.com/PowerShell/PSScriptAnalyzer/issues/1708
|
|
foreach($script in Get-ChildItem -LiteralPath build -Recurse -File | Where-Object Extension -In '.ps1', '.psm1', '.psd1')
|
|
{
|
|
Write-Output "Analyzing $($script.Name)"
|
|
try
|
|
{
|
|
$findings = @(
|
|
Invoke-ScriptAnalyzer -Path $script.FullName -Settings ./PSScriptAnalyzerSettings.psd1 -IncludeRule PSUseCorrectCasing
|
|
Invoke-ScriptAnalyzer -Path $script.FullName -Settings ./PSScriptAnalyzerSettings.psd1 -ExcludeRule PSUseCorrectCasing
|
|
)
|
|
}
|
|
catch
|
|
{
|
|
Write-Output $_.Exception.ToString()
|
|
throw
|
|
}
|
|
if($findings.Count -gt 0) { $findings | Format-Table; throw "Script analysis failed: $($script.Name)" }
|
|
}
|
|
- name: Verify script boundary tests
|
|
shell: pwsh
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
Install-Module Pester -RequiredVersion 5.7.1 -Scope CurrentUser -Force
|
|
Import-Module Pester -RequiredVersion 5.7.1
|
|
$testConfiguration = New-PesterConfiguration
|
|
$testConfiguration.Run.Path = @('build/Assert-Coverage.Tests.ps1', 'build/GitHubRepository.Tests.ps1', 'build/Distribution.Tests.ps1', 'build/InstalledUpdates.Tests.ps1', 'build/PackageBytes.Tests.ps1', 'build/ReleaseSigning.Tests.ps1')
|
|
$testConfiguration.Run.Exit = $true
|
|
$testConfiguration.TestResult.Enabled = $true
|
|
$testConfiguration.TestResult.OutputPath = 'TestResults/coverage-gate.xml'
|
|
Invoke-Pester -Configuration $testConfiguration
|