bot-agents/tests/workflow.test.ts

import { readdir, readFile, rm, stat } from "node:fs/promises";
import process from "node:process";

import { assert, expect, test } from "vite-plus/test";
import { parse } from "yaml";

import { isMapping, isNotFound, makeTempDir, output } from "#testing";
import type { JsonObject } from "#testing";

const mapping = (value: unknown, at: string): JsonObject => {
  assert(isMapping(value), at);
  return value;
};

const sequence = (value: unknown, at: string): JsonObject[] => {
  assert(Array.isArray(value), at);
  return value.map((entry: unknown, index) => mapping(entry, `${at}[${index}]`));
};

async function yaml(path: string): Promise<JsonObject> {
  const value: unknown = parse(await readFile(path, "utf8"));
  return mapping(value, path);
}

async function yamlFiles(): Promise<string[]> {
  const entries = await readdir(".", { recursive: true, withFileTypes: true });
  return entries
    .filter((entry) => entry.isFile() && /\.ya?ml$/u.test(entry.name))
    .map((entry) => `${entry.parentPath}/${entry.name}`.replace(/^\.\//u, ""))
    .filter((path) => !/^(?:\.git|\.superpowers|node_modules)\//u.test(path));
}

const findStep = (steps: JsonObject[], key: string, value: string): JsonObject => {
  const step = steps.find((entry) => entry[key] === value);
  assert(step !== undefined, `${key}: ${value}`);
  return step;
};

test("all committed YAML parses", async () => {
  const files = await yamlFiles();
  assert(files.length > 0);
  await Promise.all(files.map((file) => yaml(file)));
});

test("the action exposes only the master key and scopes it to preparation", async () => {
  const action = await yaml("action.yml");
  expect(Object.keys(mapping(action.inputs, "inputs"))).toStrictEqual(["master-key"]);
  const steps = sequence(mapping(action.runs, "runs").steps, "runs.steps");
  for (const step of steps) {
    if (typeof step.run === "string") {
      expect(step.run.includes("\n"), String(step.name)).toBe(false);
    }
  }
  const checkout = findStep(steps, "uses", "actions/checkout@v4");
  const prepare = findStep(steps, "id", "prepare");
  const agent = findStep(steps, "id", "agent");
  const post = findStep(steps, "id", "post");
  findStep(steps, "id", "source");
  expect(mapping(checkout.with, "checkout.with").token).toBe("${{ gitea.token }}");
  expect(mapping(prepare.env, "prepare.env").BOT_AGENTS_MASTER_KEY).toBe(
    "${{ inputs.master-key }}",
  );
  expect(JSON.stringify(agent).includes("BOT_AGENTS_MASTER_KEY")).toBe(false);
  expect(JSON.stringify(post).includes("BOT_AGENTS_MASTER_KEY")).toBe(false);
  expect(mapping(agent.env, "agent.env").GITEA_TOKEN).toBe("${{ gitea.token }}");
  assert(String(post.if).includes("always()"));
  for (const step of [prepare, agent, post]) {
    assert(String(step.run).includes("steps.source.outputs.path"));
  }
});

test("the source protection script stages immutable action files", async () => {
  const temp = await makeTempDir();
  const outputFile = `${temp}/output`;
  try {
    const result = await output("/bin/bash", {
      args: ["scripts/protect-source.sh"],
      env: { ACTION_PATH: process.cwd(), GITHUB_OUTPUT: outputFile, RUNNER_TEMP: temp },
      stderr: "piped",
    });
    assert(result.success, new TextDecoder().decode(result.stderr));

    const path = (await readFile(outputFile, "utf8")).trim().slice(5);
    const files = [
      "src/prepare.ts",
      "src/run.ts",
      "src/post.ts",
      "package.json",
      "profiles.json",
      "prompt.md",
    ];
    const stats = await Promise.all(files.map((file) => stat(`${path}/${file}`)));
    for (const [index, info] of stats.entries()) {
      assert(info.isFile(), files[index]);
      expect(info.mode & 0o022, files[index]).toStrictEqual(0);
    }
  } finally {
    await rm(temp, { recursive: true });
  }
});

test("module-relative runtime assets exist", async () => {
  const module = new URL("../src/run.ts", import.meta.url);
  const source = await readFile(module, "utf8");
  const assets = [...source.matchAll(/new URL\("([^"]+)", import\.meta\.url\)/gu)].map(
    ([, asset = ""]) => new URL(asset, module),
  );
  const stats = await Promise.all(assets.map((asset) => stat(asset)));
  for (const [index, info] of stats.entries()) {
    assert(info.isFile(), assets[index]?.pathname);
  }
});

test("the repository uses its trusted main action", async () => {
  const workflow = await yaml(".gitea/workflows/agents.yml");
  const job = mapping(mapping(workflow.jobs, "jobs").agent, "jobs.agent");
  const permissions = mapping(job.permissions, "jobs.agent.permissions");
  expect(permissions).toStrictEqual({
    code: "write",
    issues: "write",
    "pull-requests": "write",
  });
  const steps = sequence(job.steps, "jobs.agent.steps");
  expect(steps.findIndex((step) => step.uses === "./")).toStrictEqual(-1);
  const trusted = findStep(steps, "uses", "https://git.capsulizers.com/commons/bot-agents@main");
  expect(mapping(trusted.with, "trusted.with")["master-key"]).toBe(
    "${{ secrets.BOT_AGENTS_MASTER_KEY }}",
  );
  expect(JSON.stringify(workflow).includes("gitea.actor != 'bot'")).toBe(true);
});

test("CI checks every phase and the root isolation suite", async () => {
  const workflow = await yaml(".gitea/workflows/check.yml");
  const job = mapping(mapping(workflow.jobs, "jobs").check, "jobs.check");
  const commands = sequence(job.steps, "jobs.check.steps")
    .map((step) => (typeof step.run === "string" ? step.run : ""))
    .join("\n");
  // `vp check` type-checks every phase, and `vp test` runs each of them under
  // Node as well as the root-only isolation tests.
  assert(commands.includes("npm ci"));
  assert(commands.includes("vp check"));
  assert(commands.includes("vp test"));
});

test("uses the standard Skills installer without custom discovery", async () => {
  const runner = await readFile("src/run.ts", "utf8");
  assert(runner.includes("skills add obra/superpowers"));
  const removed = await stat("superpowers.ts").then(
    () => false,
    (error: unknown) => isNotFound(error),
  );
  assert(removed, "superpowers.ts should be removed");
});

test("installs the OpenCode CLI", async () => {
  const action = await readFile("action.yml", "utf8");
  assert(action.includes("opencode-ai"));
});

test("profile preparation does not receive provider credentials", async () => {
  const runner = await readFile("src/run.ts", "utf8");
  assert(runner.includes("await prepareProfile(profile);"));
  expect(runner.includes("prepareProfile(profile, token)")).toBe(false);
});

test("central profiles fall back from Codex to Claude to OpenCode", async () => {
  const credentials: unknown = JSON.parse(await readFile("profiles.json", "utf8"));
  const profiles = sequence(mapping(credentials, "profiles.json").profiles, "profiles");
  expect(profiles.map((profile) => profile.type)).toStrictEqual(["codex", "claude", "opencode"]);
  expect(profiles[2]?.model).toBe("openrouter/qwen/qwen3.8-27b");
  assert(String(profiles[2]?.token).startsWith("v1:"));
});