Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
41 commits
Select commit Hold shift + click to select a range
19978a7
fix: tests
moreorover Nov 8, 2025
cd98ec0
fix: tests
moreorover Nov 8, 2025
6f20ff6
fix: tests
moreorover Nov 8, 2025
b7e6568
initial commit
moreorover Nov 8, 2025
d48592f
Merge branch 'main' into fix/tests
moreorover Nov 8, 2025
d73c915
fix: setup pnpm
moreorover Nov 8, 2025
4d33b3d
fix: setup git user
moreorover Nov 8, 2025
a17d400
fix: setup git user
moreorover Nov 8, 2025
f744cfa
fix: coverage
moreorover Nov 8, 2025
c486e3b
remove .idea
moreorover Nov 8, 2025
baa7340
remove .idea
moreorover Nov 8, 2025
78dc847
run tests from root
moreorover Nov 8, 2025
1e112f3
increase test timeout
moreorover Nov 8, 2025
4478fa0
fix: codecov
moreorover Nov 8, 2025
c2732c6
fix: codecov
moreorover Nov 9, 2025
b1608a3
fix: coverage skip test files
moreorover Nov 9, 2025
86c08d1
Merge branch 'main' into fix/tests
moreorover Nov 10, 2025
dffee34
Merge branch 'main' into fix/tests
AmanVarshney01 Nov 10, 2025
1401ab9
Merge branch 'main' into fix/tests
moreorover Nov 10, 2025
5133348
fix: fix tests
moreorover Nov 11, 2025
9b21cf7
fix: fix tests
moreorover Nov 11, 2025
8b9a882
Revert "fix: fix tests"
moreorover Nov 11, 2025
659d2c9
fix: fix tests
moreorover Nov 11, 2025
829117e
Revert "fix: fix tests"
moreorover Nov 11, 2025
4964ecb
fix: fix tests
moreorover Nov 11, 2025
3eb883d
Merge branch 'main' into fix/tests
moreorover Nov 12, 2025
5e20990
Merge branch 'main' into fix/tests
moreorover Nov 26, 2025
61ff06e
fix: fix tests
moreorover Nov 26, 2025
a5ef83f
fix: fix tests
moreorover Nov 26, 2025
954c18d
fix: fix tests
moreorover Nov 26, 2025
2d6b332
Merge branch 'main' into fix/tests
moreorover Nov 28, 2025
1236035
Merge branch 'main' into fix/tests
moreorover Dec 9, 2025
8710d3b
fix: fix tests
moreorover Dec 9, 2025
f1be8ea
Merge branch 'main' into fix/tests
AmanVarshney01 Dec 16, 2025
194f5cc
remove vitest and use bun test instead
AmanVarshney01 Dec 16, 2025
dc58d14
fix
AmanVarshney01 Dec 16, 2025
1905e95
fix
AmanVarshney01 Dec 16, 2025
f7b1453
fix tests
AmanVarshney01 Dec 17, 2025
6d4fd7e
fix
AmanVarshney01 Dec 17, 2025
e790dea
fix
AmanVarshney01 Dec 17, 2025
209ca4a
update workflows
AmanVarshney01 Dec 17, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/release.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ on:
push:
branches:
- main
pull_request:
pull_request_target:
types: [labeled]
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Checkout of untrusted code with pull_request_target has security risk

The workflow changed from pull_request to pull_request_target and checks out github.event.pull_request.head.sha (untrusted PR code). pull_request_target runs with write permissions and access to repository secrets like NPM_TOKEN. While the 'canary' label requirement provides a gate, this pattern allows untrusted code to execute with secrets if a maintainer adds the label without careful review, or if code is pushed to the PR after review but before labeling (TOCTOU vulnerability). The safer pattern is to avoid checking out PR head code when using pull_request_target.

Additional Locations (1)

Fix in Cursor Fix in Web


jobs:
Expand Down Expand Up @@ -121,7 +121,7 @@ jobs:

canary:
runs-on: ubuntu-latest
if: github.event_name == 'pull_request' && github.event.label.name == 'canary'
if: github.event_name == 'pull_request_target' && github.event.label.name == 'canary'
steps:
- name: Checkout Code
uses: actions/checkout@v4
Expand Down
50 changes: 50 additions & 0 deletions .github/workflows/test.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
name: Test

on:
push:
branches:
- main
pull_request_review:
types: [submitted]
pull_request:
types: [labeled]

jobs:
test:
if: github.event_name == 'push' || (github.event_name == 'pull_request_review' && github.event.review.state == 'approved' && github.event.pull_request.base.ref == 'main') || (github.event_name == 'pull_request' && github.event.label.name == 'canary')
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: CI workflow doesn't run tests on PR open/sync

The PR description states the workflow "runs on every PR to main" but the actual configuration doesn't achieve this. The workflow only triggers on: (1) push to main (after merge), (2) pull_request_review when approved, or (3) pull_request when labeled with 'canary'. Tests won't run when a PR is opened or when new commits are pushed to it. This defeats the stated purpose since reviewers can't see test results before approving, and requiring the test status check would create a deadlock where approval is needed for tests to run, but tests must pass for merge.

Fix in Cursor Fix in Web

runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout@v4
with:
ref: ${{ (github.event_name == 'pull_request_review' || github.event_name == 'pull_request') && github.event.pull_request.head.sha || github.sha }}

- name: Setup Git user
shell: bash
run: |
git config --global user.name github-actions[bot]
git config --global user.email 41898282+github-actions[bot]@users.noreply.github.com
- name: Setup Bun
uses: oven-sh/setup-bun@v2
with:
bun-version: latest

- name: Setup pnpm
uses: pnpm/action-setup@v4
with:
version: 10

- name: Install Dependencies
run: bun install --frozen-lockfile
env:
BTS_TELEMETRY: 0

- name: Build Workspace Dependencies
run: cd packages/types && bun run build

- name: Run Tests
working-directory: apps/cli
run: bun run test:ci
env:
AGENT: 1
4 changes: 3 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -38,4 +38,6 @@ yarn-error.log*
.vscode
.env*.local

.smoke
.smoke

.idea
17 changes: 17 additions & 0 deletions apps/cli/bunfig.toml
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
[test]
# Preload setup file for global setup/teardown
preload = ["./test/setup.ts"]

# Per-test timeout (3 minutes for smoke tests)
timeout = 180000

# Skip test files from coverage reports
coverageSkipTestFiles = true

# Exclude patterns from coverage
coveragePathIgnorePatterns = [
"test/**",
"dist/**",
"templates/**",
"node_modules/**",
]
11 changes: 6 additions & 5 deletions apps/cli/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -51,8 +51,10 @@
"build": "tsdown --publint",
"dev": "tsdown --watch",
"check-types": "tsc --noEmit",
"test": "bun run build && vitest run; rm -rf .smoke || true",
"test:ui": "bun run build && vitest --ui",
"test": "bun run build && bun test",
"test:watch": "bun run build && bun test --watch",
"test:coverage": "bun run build && bun test --coverage",
"test:ci": "bun run build && AGENT=1 bun test --bail=5",
"prepublishOnly": "npm run build"
},
"exports": {
Expand Down Expand Up @@ -84,12 +86,11 @@
"zod": "^4.1.13"
},
"devDependencies": {
"@types/bun": "^1.2.17",
"@types/fs-extra": "^11.0.4",
"@types/node": "^24.10.2",
"@vitest/ui": "^4.0.15",
"publint": "^0.3.16",
"tsdown": "^0.17.2",
"typescript": "^5.9.3",
"vitest": "^4.0.15"
"typescript": "^5.9.3"
}
}
2 changes: 1 addition & 1 deletion apps/cli/test/addons.test.ts
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
import { describe, it } from "vitest";
import { describe, it } from "bun:test";
import type { Addons, Frontend } from "../src";
import { expectError, expectSuccess, runTRPCTest, type TestConfig } from "./test-utils";

Expand Down
Loading