Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion tests/ci-workflows.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,15 @@ function count(text: string, fragment: string): number {
return text.split(fragment).length - 1;
}

/** Match an executable shell line, not a fragment that could appear in echo or a comment. */
function hasExactShellCommand(run: string | undefined, expected: string): boolean {
return (run ?? "")
.split(/\r?\n/)
.map(line => line.trim())
.filter(line => line.length > 0 && !line.startsWith("#"))
.includes(expected);
}

function expectSecureLinuxKeyringBootstrap(workflow: string): void {
const smokeStep = workflow
.split("- name: OS keyring create/read/delete smoke")[1]
Expand Down Expand Up @@ -164,7 +173,9 @@ describe("GitHub Actions hardening", () => {
// the runner's disk and the suite passes against a tree that no longer
// exists in git.
const winSteps = (ci.jobs?.["platform-windows"] as { steps?: { if?: string; run?: string }[] })?.steps ?? [];
expect(winSteps.some(step => step.run?.includes(`--shard=\${{ matrix.shard }}/${windowsShards.length}`))).toBe(true);
const windowsTestCommand = `bun test --isolate tests --shard=\${{ matrix.shard }}/${windowsShards.length}`;
expect(hasExactShellCommand(`echo ${windowsTestCommand}`, windowsTestCommand)).toBe(false);
expect(winSteps.some(step => hasExactShellCommand(step.run, windowsTestCommand))).toBe(true);
expect(winSteps.some(step => step.if === "runner.environment == 'self-hosted'"
&& step.run?.includes("git clean -xffd"))).toBe(true);

Expand Down
Loading