commons/bot-agents
3
0
Fork 0
Code Issues Pull Requests Actions Releases 3 Activity

Replace NodeJS dict aliases with maps and named field reads

Browse Source 
Co-authored-by: Danny Kim <temeddix@gmail.com>
Co-committed-by: Danny Kim <temeddix@gmail.com>
This commit was merged in pull request #24.
This commit is contained in:
Danny Kim
2026-10-20 05:01:49 +00:00
committed by temeddix
parent 32806120b3
commit 063eb09750
42 changed files with 2386 additions and 982 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/workflow.test.ts
+118 -54
View File
@@ -3,24 +3,27 @@ import process from "node:process";
import { assert, expect, test } from "vite-plus/test";
import { parse } from "yaml";
import { makeTempDir, runCommand } from "#testing";
import { inheritedEnvironment, makeTempDir, runCommand } from "#testing";
type JsonObject = NodeJS.Dict<unknown>;
// A parsed YAML or JSON mapping, keyed by its dynamic field names.
type Mapping = Map<string, unknown>;
const isMapping = (value: unknown): value is JsonObject =>
typeof value === "object" && value !== null && !Array.isArray(value);
const mapping = (value: unknown, at: string): JsonObject => {
assert(isMapping(value), at);
return value;
const mapping = (value: unknown, at: string): Mapping => {
assert(
typeof value === "object" && value !== null && !Array.isArray(value),
at,
);
return new Map(Object.entries(value));
};
const sequence = (value: unknown, at: string): JsonObject[] => {
const sequence = (value: unknown, at: string): Mapping[] => {
assert(Array.isArray(value), at);
return value.map((entry: unknown, index) => mapping(entry, `${at}[${index}]`));
return value.map((entry: unknown, index) =>
mapping(entry, `${at}[${index}]`),
);
};
async function yaml(path: string): Promise<JsonObject> {
async function yaml(path: string): Promise<Mapping> {
const value: unknown = parse(await readFile(path, "utf8"));
return mapping(value, path);
}
@@ -33,8 +36,8 @@ async function yamlFiles(): Promise<string[]> {
.filter((path) => !/^(?:\.git|\.superpowers|node_modules)\//u.test(path));
}
const findStep = (steps: JsonObject[], key: string, value: string): JsonObject => {
const step = steps.find((entry) => entry[key] === value);
const findStep = (steps: Mapping[], key: string, value: string): Mapping => {
const step = steps.find((entry) => entry.get(key) === value);
assert(step !== undefined, `${key}: ${value}`);
return step;
};
@@ -42,16 +45,26 @@ const findStep = (steps: JsonObject[], key: string, value: string): JsonObject =
test("all committed YAML parses", async () => {
const files = await yamlFiles();
assert(files.length > 0);
await Promise.all(files.map((file) => yaml(file)));
await Promise.all(
files.map(async (file) => {
await yaml(file);
}),
);
});
test("the action exposes only the master key and scopes it to preparation", async () => {
const action = await yaml("action.yml");
expect(Object.keys(mapping(action["inputs"], "inputs"))).toStrictEqual(["master-key"]);
const steps = sequence(mapping(action["runs"], "runs")["steps"], "runs.steps");
expect([...mapping(action.get("inputs"), "inputs").keys()]).toStrictEqual([
"master-key",
]);
const steps = sequence(
mapping(action.get("runs"), "runs").get("steps"),
"runs.steps",
);
for (const step of steps) {
if (typeof step["run"] === "string") {
expect(step["run"].includes("\n"), String(step["name"])).toBe(false);
const run = step.get("run");
if (typeof run === "string") {
expect(run.includes("\n"), String(step.get("name"))).toBe(false);
}
}
const checkout = findStep(steps, "uses", "actions/checkout@v4");
@@ -59,16 +72,24 @@ test("the action exposes only the master key and scopes it to preparation", asyn
const agent = findStep(steps, "id", "agent");
const post = findStep(steps, "id", "post");
findStep(steps, "id", "source");
expect(mapping(checkout["with"], "checkout.with")["token"]).toBe("${{ gitea.token }}");
expect(mapping(prepare["env"], "prepare.env")["BOT_AGENTS_MASTER_KEY"]).toBe(
"${{ inputs.master-key }}",
expect(mapping(checkout.get("with"), "checkout.with").get("token")).toBe(
"${{ gitea.token }}",
);
expect(JSON.stringify(agent).includes("BOT_AGENTS_MASTER_KEY")).toBe(false);
expect(JSON.stringify(post).includes("BOT_AGENTS_MASTER_KEY")).toBe(false);
expect(mapping(agent["env"], "agent.env")["GITEA_TOKEN"]).toBe("${{ gitea.token }}");
assert(String(post["if"]).includes("always()"));
expect(
mapping(prepare.get("env"), "prepare.env").get("BOT_AGENTS_MASTER_KEY"),
).toBe("${{ inputs.master-key }}");
expect(
JSON.stringify(Object.fromEntries(agent)).includes("BOT_AGENTS_MASTER_KEY"),
).toBe(false);
expect(
JSON.stringify(Object.fromEntries(post)).includes("BOT_AGENTS_MASTER_KEY"),
).toBe(false);
expect(mapping(agent.get("env"), "agent.env").get("GITEA_TOKEN")).toBe(
"${{ gitea.token }}",
);
assert(String(post.get("if")).includes("always()"));
for (const step of [prepare, agent, post]) {
assert(String(step["run"]).includes("steps.source.outputs.path"));
assert(String(step.get("run")).includes("steps.source.outputs.path"));
}
});
@@ -76,15 +97,19 @@ test("the source protection script stages immutable action files", async () => {
const temp = await makeTempDir();
const outputFile = `${temp}/output`;
try {
const result = await runCommand("/bin/bash", ["scripts/protect-source.sh"], {
...process.env,
ACTION_PATH: process.cwd(),
GITHUB_OUTPUT: outputFile,
RUNNER_TEMP: temp,
});
const environment = inheritedEnvironment();
environment.set("ACTION_PATH", process.cwd());
environment.set("GITHUB_OUTPUT", outputFile);
environment.set("RUNNER_TEMP", temp);
const result = await runCommand(
"/bin/bash",
["scripts/protect-source.sh"],
environment,
);
assert(result.success, result.stderr);
const path = (await readFile(outputFile, "utf8")).trim().slice(5);
const output = await readFile(outputFile, "utf8");
const path = output.trim().slice(5);
const files = [
"src/prepare/index.ts",
"src/run/index.ts",
@@ -95,7 +120,12 @@ test("the source protection script stages immutable action files", async () => {
"profiles.json",
"prompt.md",
];
const stats = await Promise.all(files.map((file) => stat(`${path}/${file}`)));
const stats = await Promise.all(
files.map(async (file) => {
const info = await stat(`${path}/${file}`);
return info;
}),
);
for (const [index, info] of stats.entries()) {
assert(info.isFile(), files[index]);
expect(info.mode & 0o022, files[index]).toStrictEqual(0);
@@ -108,10 +138,15 @@ test("the source protection script stages immutable action files", async () => {
test("module-relative runtime assets exist", async () => {
const module = new URL("../src/run/index.ts", import.meta.url);
const source = await readFile(module, "utf8");
const assets = [...source.matchAll(/new URL\("([^"]+)", import\.meta\.url\)/gu)].map(
([, asset = ""]) => new URL(asset, module),
const assets = [
...source.matchAll(/new URL\("(?<asset>[^"]+)", import\.meta\.url\)/gu),
].map(([, asset = ""]) => new URL(asset, module));
const stats = await Promise.all(
assets.map(async (asset) => {
const info = await stat(asset);
return info;
}),
);
const stats = await Promise.all(assets.map((asset) => stat(asset)));
for (const [index, info] of stats.entries()) {
assert(info.isFile(), assets[index]?.pathname);
}
@@ -119,27 +154,46 @@ test("module-relative runtime assets exist", async () => {
test("the repository uses its trusted main action", async () => {
const workflow = await yaml(".gitea/workflows/agents.yml");
const job = mapping(mapping(workflow["jobs"], "jobs")["agent"], "jobs.agent");
const permissions = mapping(job["permissions"], "jobs.agent.permissions");
expect(permissions).toStrictEqual({
const job = mapping(
mapping(workflow.get("jobs"), "jobs").get("agent"),
"jobs.agent",
);
const permissions = mapping(job.get("permissions"), "jobs.agent.permissions");
expect(Object.fromEntries(permissions)).toStrictEqual({
code: "write",
issues: "write",
"pull-requests": "write",
});
const steps = sequence(job["steps"], "jobs.agent.steps");
expect(steps.findIndex((step) => step["uses"] === "./")).toStrictEqual(-1);
const trusted = findStep(steps, "uses", "https://git.capsulizers.com/commons/bot-agents@main");
expect(mapping(trusted["with"], "trusted.with")["master-key"]).toBe(
const steps = sequence(job.get("steps"), "jobs.agent.steps");
expect(steps.findIndex((step) => step.get("uses") === "./")).toStrictEqual(
-1,
);
const trusted = findStep(
steps,
"uses",
"https://git.capsulizers.com/commons/bot-agents@main",
);
expect(mapping(trusted.get("with"), "trusted.with").get("master-key")).toBe(
"${{ secrets.BOT_AGENTS_MASTER_KEY }}",
);
expect(JSON.stringify(workflow).includes("gitea.actor != 'bot'")).toBe(true);
expect(
JSON.stringify(Object.fromEntries(workflow)).includes(
"gitea.actor != 'bot'",
),
).toBe(true);
});
test("CI checks every phase and the root isolation suite", async () => {
const workflow = await yaml(".gitea/workflows/check.yml");
const job = mapping(mapping(workflow["jobs"], "jobs")["check"], "jobs.check");
const commands = sequence(job["steps"], "jobs.check.steps")
.map((step) => (typeof step["run"] === "string" ? step["run"] : ""))
const job = mapping(
mapping(workflow.get("jobs"), "jobs").get("check"),
"jobs.check",
);
const commands = sequence(job.get("steps"), "jobs.check.steps")
.map((step) => {
const run = step.get("run");
return typeof run === "string" ? run : "";
})
.join("\n");
// `vp check` type-checks every phase, and `vp test` runs each of them under
// Node as well as the root-only isolation tests.
@@ -153,7 +207,8 @@ test("uses the standard Skills installer without custom discovery", async () =>
assert(runner.includes("skills add obra/superpowers"));
const removed = await stat("superpowers.ts").then(
() => false,
(error: unknown) => error instanceof Error && "code" in error && error.code === "ENOENT",
(error: unknown) =>
error instanceof Error && "code" in error && error.code === "ENOENT",
);
assert(removed, "superpowers.ts should be removed");
});
@@ -175,9 +230,18 @@ test("profile preparation does not receive provider credentials", async () => {
});
test("central profiles fall back from Codex to Claude to OpenCode", async () => {
const credentials: unknown = JSON.parse(await readFile("profiles.json", "utf8"));
const profiles = sequence(mapping(credentials, "profiles.json")["profiles"], "profiles");
expect(profiles.map((profile) => profile["type"])).toStrictEqual(["codex", "claude", "opencode"]);
expect(profiles[2]?.["model"]).toBe("openrouter/qwen/qwen3.8-27b");
assert(String(profiles[2]?.["token"]).startsWith("v1:"));
const credentials: unknown = JSON.parse(
await readFile("profiles.json", "utf8"),
);
const profiles = sequence(
mapping(credentials, "profiles.json").get("profiles"),
"profiles",
);
expect(profiles.map((profile) => profile.get("type"))).toStrictEqual([
"CODEX",
"CLAUDE",
"OPENCODE",
]);
expect(profiles[2]?.get("model")).toBe("openrouter/qwen/qwen3.8-27b");
assert(String(profiles[2]?.get("token")).startsWith("v1:"));
});