Move the action from Deno to Node.js and Vite+

2026-10-16 02:20:49 +09:00
parent 9b55e98d8c
commit 8f23da2b42
45 changed files with 5664 additions and 1731 deletions
@@ -0,0 +1,27 @@
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+import { expect, test } from "vite-plus/test";
+
+import { output } from "../src/command.ts";
+
+// Each phase runs as `node src/<phase>.ts` with no build step. Node loads the
+// whole import graph, stripping types, before the phase reads its first
+// variable, so failing on that variable proves every module loads.
+const PHASES: [phase: string, firstVariable: string][] = [
+  ["prepare", "ACTION_PATH"],
+  ["run", "GITEA_API_URL"],
+  ["post", "BOT_AGENTS_MANIFEST"],
+];
+
+test.each(PHASES)("Node loads the %s phase", async (phase, firstVariable) => {
+  const path = fileURLToPath(new URL(`../src/${phase}.ts`, import.meta.url));
+  const result = await output(process.execPath, {
+    args: [path],
+    env: { PATH: process.env.PATH ?? "" },
+    clearEnv: true,
+    stdin: "null",
+  });
+  expect(result.success).toBe(false);
+  expect(new TextDecoder().decode(result.stderr)).toContain(`${firstVariable} is not set`);
+});
@@ -0,0 +1,175 @@
+import { readdir, readFile, rm, stat } from "node:fs/promises";
+import process from "node:process";
+
+import { assert, expect, test } from "vite-plus/test";
+import { parse } from "yaml";
+
+import { output } from "../src/command.ts";
+import { isNotFound } from "../src/errors.ts";
+import { isMapping } from "../src/json.ts";
+import type { JsonObject } from "../src/json.ts";
+import { makeTempDir } from "../src/testing.ts";
+
+const mapping = (value: unknown, at: string): JsonObject => {
+  assert(isMapping(value), at);
+  return value;
+};
+
+const sequence = (value: unknown, at: string): JsonObject[] => {
+  assert(Array.isArray(value), at);
+  return value.map((entry: unknown, index) => mapping(entry, `${at}[${index}]`));
+};
+
+async function yaml(path: string): Promise<JsonObject> {
+  const value: unknown = parse(await readFile(path, "utf8"));
+  return mapping(value, path);
+}
+
+async function yamlFiles(): Promise<string[]> {
+  const entries = await readdir(".", { recursive: true, withFileTypes: true });
+  return entries
+    .filter((entry) => entry.isFile() && /\.ya?ml$/u.test(entry.name))
+    .map((entry) => `${entry.parentPath}/${entry.name}`.replace(/^\.\//u, ""))
+    .filter((path) => !/^(?:\.git|\.superpowers|node_modules)\//u.test(path));
+}
+
+const findStep = (steps: JsonObject[], key: string, value: string): JsonObject => {
+  const step = steps.find((entry) => entry[key] === value);
+  assert(step !== undefined, `${key}: ${value}`);
+  return step;
+};
+
+test("all committed YAML parses", async () => {
+  const files = await yamlFiles();
+  assert(files.length > 0);
+  await Promise.all(files.map((file) => yaml(file)));
+});
+
+test("the action exposes only the master key and scopes it to preparation", async () => {
+  const action = await yaml("action.yml");
+  expect(Object.keys(mapping(action.inputs, "inputs"))).toStrictEqual(["master-key"]);
+  const steps = sequence(mapping(action.runs, "runs").steps, "runs.steps");
+  for (const step of steps) {
+    if (typeof step.run === "string") {
+      expect(step.run.includes("\n"), String(step.name)).toBe(false);
+    }
+  }
+  const checkout = findStep(steps, "uses", "actions/checkout@v4");
+  const prepare = findStep(steps, "id", "prepare");
+  const agent = findStep(steps, "id", "agent");
+  const post = findStep(steps, "id", "post");
+  findStep(steps, "id", "source");
+  expect(mapping(checkout.with, "checkout.with").token).toBe("${{ gitea.token }}");
+  expect(mapping(prepare.env, "prepare.env").BOT_AGENTS_MASTER_KEY).toBe(
+    "${{ inputs.master-key }}",
+  );
+  expect(JSON.stringify(agent).includes("BOT_AGENTS_MASTER_KEY")).toBe(false);
+  expect(JSON.stringify(post).includes("BOT_AGENTS_MASTER_KEY")).toBe(false);
+  expect(mapping(agent.env, "agent.env").GITEA_TOKEN).toBe("${{ gitea.token }}");
+  assert(String(post.if).includes("always()"));
+  for (const step of [prepare, agent, post]) {
+    assert(String(step.run).includes("steps.source.outputs.path"));
+  }
+});
+
+test("the source protection script stages immutable action files", async () => {
+  const temp = await makeTempDir();
+  const outputFile = `${temp}/output`;
+  try {
+    const result = await output("/bin/bash", {
+      args: ["scripts/protect-source.sh"],
+      env: { ACTION_PATH: process.cwd(), GITHUB_OUTPUT: outputFile, RUNNER_TEMP: temp },
+      stderr: "piped",
+    });
+    assert(result.success, new TextDecoder().decode(result.stderr));
+
+    const path = (await readFile(outputFile, "utf8")).trim().slice(5);
+    const files = [
+      "src/prepare.ts",
+      "src/run.ts",
+      "src/post.ts",
+      "package.json",
+      "profiles.json",
+      "prompt.md",
+    ];
+    const stats = await Promise.all(files.map((file) => stat(`${path}/${file}`)));
+    for (const [index, info] of stats.entries()) {
+      assert(info.isFile(), files[index]);
+      expect(info.mode & 0o022, files[index]).toStrictEqual(0);
+    }
+  } finally {
+    await rm(temp, { recursive: true });
+  }
+});
+
+test("module-relative runtime assets exist", async () => {
+  const module = new URL("../src/run.ts", import.meta.url);
+  const source = await readFile(module, "utf8");
+  const assets = [...source.matchAll(/new URL\("([^"]+)", import\.meta\.url\)/gu)].map(
+    ([, asset = ""]) => new URL(asset, module),
+  );
+  const stats = await Promise.all(assets.map((asset) => stat(asset)));
+  for (const [index, info] of stats.entries()) {
+    assert(info.isFile(), assets[index]?.pathname);
+  }
+});
+
+test("the repository uses its trusted main action", async () => {
+  const workflow = await yaml(".gitea/workflows/agents.yml");
+  const job = mapping(mapping(workflow.jobs, "jobs").agent, "jobs.agent");
+  const permissions = mapping(job.permissions, "jobs.agent.permissions");
+  expect(permissions).toStrictEqual({
+    code: "write",
+    issues: "write",
+    "pull-requests": "write",
+  });
+  const steps = sequence(job.steps, "jobs.agent.steps");
+  expect(steps.findIndex((step) => step.uses === "./")).toStrictEqual(-1);
+  const trusted = findStep(steps, "uses", "https://git.capsulizers.com/commons/bot-agents@main");
+  expect(mapping(trusted.with, "trusted.with")["master-key"]).toBe(
+    "${{ secrets.BOT_AGENTS_MASTER_KEY }}",
+  );
+  expect(JSON.stringify(workflow).includes("gitea.actor != 'bot'")).toBe(true);
+});
+
+test("CI checks every phase and the root isolation suite", async () => {
+  const workflow = await yaml(".gitea/workflows/check.yml");
+  const job = mapping(mapping(workflow.jobs, "jobs").check, "jobs.check");
+  const commands = sequence(job.steps, "jobs.check.steps")
+    .map((step) => (typeof step.run === "string" ? step.run : ""))
+    .join("\n");
+  // `vp check` type-checks every phase, and `vp test` runs each of them under
+  // Node as well as the root-only isolation tests.
+  assert(commands.includes("npm ci"));
+  assert(commands.includes("vp check"));
+  assert(commands.includes("vp test"));
+});
+
+test("uses the standard Skills installer without custom discovery", async () => {
+  const runner = await readFile("src/run.ts", "utf8");
+  assert(runner.includes("skills add obra/superpowers"));
+  const removed = await stat("superpowers.ts").then(
+    () => false,
+    (error: unknown) => isNotFound(error),
+  );
+  assert(removed, "superpowers.ts should be removed");
+});
+
+test("installs the OpenCode CLI", async () => {
+  const action = await readFile("action.yml", "utf8");
+  assert(action.includes("opencode-ai"));
+});
+
+test("profile preparation does not receive provider credentials", async () => {
+  const runner = await readFile("src/run.ts", "utf8");
+  assert(runner.includes("await prepareProfile(profile);"));
+  expect(runner.includes("prepareProfile(profile, token)")).toBe(false);
+});
+
+test("central profiles fall back from Codex to Claude to OpenCode", async () => {
+  const credentials: unknown = JSON.parse(await readFile("profiles.json", "utf8"));
+  const profiles = sequence(mapping(credentials, "profiles.json").profiles, "profiles");
+  expect(profiles.map((profile) => profile.type)).toStrictEqual(["codex", "claude", "opencode"]);
+  expect(profiles[2]?.model).toBe("openrouter/qwen/qwen3.8-27b");
+  assert(String(profiles[2]?.token).startsWith("v1:"));
+});