ci: add sample-app PR gate

[Raina451]

Sample-app PR gate

Adds scripts/check-samples.mjs and a Sample App Checks workflow that enforces the sample-app conventions.

Rules

Rule	Applies to
has uipath.json.example	all apps
.gitignore present and ignores .uipath	all apps
README has a Preview heading with an image/gif/video	all apps
index.html favicon <link> points at a file that exists	apps with index.html
a coded-apps harness dep (@uipath/coded-apps-dev, or @uipath/coded-action-app for action apps)	apps with index.html
vite.config sets base: './' and (non-action apps) imports @uipath/coded-apps-dev	apps with a vite config

Apps are auto-discovered (any tracked package.json under samples/). Rules are pure functions with a --selftest. Run all apps locally: npm run check:samples.

How the files are read

The favicon rule reads an attribute out of index.html, so it parses the HTML with node-html-parser rather than a regex. The rest are grep-style checks (does the README mention media, does the vite config contain base: './'), which is what regex and String.includes are for. The vite check greps the source on purpose: loading the config to read base would need npm ci per app, which is too heavy for a structural gate.

Scope: changed apps only (for now)

The CI job runs --changed, gating only the sample apps touched in a PR. Existing apps currently have 47 violations (mostly missing demo gifs/favicons and per-app config the app owners need to supply). Rather than block every PR on that backlog, each app becomes enforced the next time it is changed. Flip CI to a full npm run check:samples once the backlog is cleared.

Generated with Claude Code

[claude]

Review summary

One issue found:

scripts/check-samples.mjs lines 155–156 — Module side-effect fires at import time. checkApp is exported for testability but run() (which spawns git ls-files) executes unconditionally on import. Guard with the ES-module main-check (import.meta.url === process.argv[1]) so the function is safely importable by unit tests.

[claude]

Review summary

One new finding this run:

.github/workflows/sample-checks.yml line 22 — Missing install step. The script opens with a top-level ESM import of node-html-parser, which is evaluated at load time. Every workflow run will fail with ERR_MODULE_NOT_FOUND before any checks execute. Needs a npm ci step between Setup Node.js and the check step.

(Three previously-raised threads on scripts/check-samples.mjs — selftest coverage gaps, unconditional run() at import, and previewSection off-by-one — remain open.)

[claude]

Review summary

One new finding this run:

scripts/check-samples.mjs line 136 — exists uses existsSync (filesystem) while has uses git tracking (tracked.has). When a developer runs npm run check:samples locally with an untracked favicon file on disk, the favicon rule passes — but CI (clean checkout) will fail. Fix: exists: file => tracked.has(${dir}/${file}) to make both callbacks use the same source of truth.

(Four previously-raised threads remain open: missing npm ci in the workflow, unconditional run() at import time, previewSection off-by-one, and selftest coverage gaps for example-config / coded-apps-dev.)

[claude]

Review summary

One new finding this run:

.github/workflows/sample-checks.yml line 29 — Missing selftest invocation. PRs that modify rule logic in check-samples.mjs but touch no sample apps will run --changed against 0 apps and exit 0, so a logic regression silently passes CI. Suggest running --selftest before (or alongside) the main check step — depends on the open npm ci thread at line 22 being resolved first.

(Five previously-raised threads remain open: missing npm ci in the workflow, unconditional run() at import time, previewSection off-by-one, selftest coverage gaps for example-config/coded-apps-dev, and exists using existsSync vs. git tracking.)

[claude]

Review summary

One new finding this run:

.github/workflows/pr-checks.yml line 105 — Empty BASE_REF on workflow_dispatch. When the workflow is triggered manually, github.base_ref is an empty string, so the check step runs --changed "origin/". The || 'origin/main' fallback in the script doesn't help because "origin/" is truthy — git then rejects origin/...HEAD as an invalid ref and the step fails. Suggested fix: guard the step with if [ -n "$BASE_REF" ]; then ... else node scripts/check-samples.mjs; fi.

[claude]

✅ No issues found. Checked for bugs and CLAUDE.md compliance.

[claude]

The previewSection off-by-one fix changed slice(start + 1, …) to slice(start, …) specifically to handle media placed directly on the heading line (e.g. ## Preview ![](./demo.gif)). Neither of the two existing readme-preview tests exercises that case:

• '# App\n## Preview\n![](./demo.gif)\n' — media is on the next line; both old and new slice would match.
• '# App\n## Preview\njust text' — no media anywhere; both would fail.

If the slice were accidentally reverted to start + 1, all current tests would still pass. Suggest adding:

Suggested change

	});
	});
	it('passes when media is placed on the Preview heading line', () => {
	expect(rules({ ...clean, 'README.md': '# App\n## Preview \n' })).not.toContain('readme-preview');
	});
	it('flags a missing favicon link', () => {

[claude]

Review summary

One new finding:

tests/unit/scripts/check-samples.test.ts line 37 — Missing test for media on the Preview heading line. The previewSection off-by-one fix (slice(start) instead of slice(start+1)) was specifically for the case where media sits on the heading line itself (e.g. ## Preview ). Neither existing readme-preview test exercises that case, so reverting the fix would silently pass the whole suite. Suggested test added inline.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud