chore(release): sync v1.8.0-rc.4 to main (#1450)

Promotes dev/v1.8 at 00fab7f (tree e195658) for v1.8.0-rc.4.

Author: scttbnsn

.github/tests/ci-verify-workflow.test.ts

@@ -44,9 +44,17 @@ function loadLefthook(): LefthookDefinition {
   return yaml.parse(readFileSync(lefthookPath, 'utf8')) as LefthookDefinition;
 }
 
+// CI-5: the old single test job is split into shard jobs plus the aggregating
+// `test` job that keeps the required check name.
+const testShardJobIds = ['test-repo', 'test-app', 'test-ui', 'test'];
+
 function getTestJobStep(name: string): WorkflowStep | undefined {
   const workflow = loadWorkflow();
-  return workflow.jobs?.test?.steps?.find((step) => step.name === name);
+  for (const jobId of testShardJobIds) {
+    const step = workflow.jobs?.[jobId]?.steps?.find((candidate) => candidate.name === name);
+    if (step) return step;
+  }
+  return undefined;
 }
 
 test('UI coverage captures bounded resource evidence without changing the gate', () => {
@@ -389,9 +397,20 @@ test('ci-verify can dispatch the complete release-candidate matrix manually', ()
     expect(workflow.jobs?.[jobId]?.if).toContain("github.event_name == 'workflow_dispatch'");
   }
 
-  for (const jobId of ['security-actions', 'changes', 'lint', 'test', 'build']) {
+  for (const jobId of [
+    'security-actions',
+    'changes',
+    'lint',
+    'test-repo',
+    'test-app',
+    'test-ui',
+    'build',
+  ]) {
     expect(workflow.jobs?.[jobId]?.if).toBeUndefined();
   }
+  // The aggregating required check must run after a failed shard so it can
+  // report failure itself; a skipped required check counts as passing.
+  expect(workflow.jobs?.test?.if).toBe('always()');
 
   expect(workflow.jobs?.codeql?.needs).toStrictEqual(['security-actions']);
   expect(workflow.jobs?.fuzz?.needs).toStrictEqual(['security-actions']);
@@ -682,3 +701,95 @@ test('the advisory ci-timing job cannot fail the run or gate a release', () => {
   );
   expect(releaseCut).not.toMatch(/ci-timing|CI timing/);
 });
+
+test('test suites are sharded and a final job keeps the required check name', () => {
+  const workflow = loadWorkflow();
+
+  expect(workflow.jobs?.test?.name).toBe('Quality: Test & Coverage');
+  expect(workflow.jobs?.test?.needs).toStrictEqual(['test-repo', 'test-app', 'test-ui']);
+  for (const jobId of ['test-repo', 'test-app', 'test-ui']) {
+    expect(workflow.jobs?.[jobId]?.needs).toBeUndefined();
+    expect(workflow.jobs?.[jobId]?.name).not.toBe('Quality: Test & Coverage');
+  }
+
+  // Shards run the same commands the pre-push coverage gate runs, so the
+  // per-workspace 100% thresholds stay enforced where the tests execute.
+  expect(getWorkflowStep('test-app', 'Run app tests')).toMatchObject({
+    run: 'npm test',
+    'working-directory': 'app',
+  });
+  expect(getWorkflowStep('test-ui', 'Run ui tests')?.run).toContain(
+    'npm run test:unit -- --maxWorkers=1',
+  );
+  expect(getWorkflowStep('test-ui', 'Typecheck ui')).toMatchObject({
+    run: 'npm run typecheck',
+    'working-directory': 'ui',
+  });
+
+  // build gates on the aggregate, not on individual shards.
+  expect(workflow.jobs?.build?.needs).toStrictEqual(['lint', 'test']);
+});
+
+test('coverage shards hand lcov and gap reports to the aggregating job', () => {
+  for (const [jobId, workspace] of [
+    ['test-app', 'app'],
+    ['test-ui', 'ui'],
+  ]) {
+    const lcov = getWorkflowStep(jobId, 'Upload coverage report');
+    expect(lcov?.if).toBe('always()');
+    expect(lcov?.with).toMatchObject({
+      name: `coverage-shard-${workspace}`,
+      path: `${workspace}/coverage/lcov.info`,
+    });
+
+    const gaps = getWorkflowStep(jobId, 'Write coverage gap report');
+    expect(gaps?.if).toBe('failure()');
+    expect(gaps?.run).toContain(`--workspace ${workspace}`);
+    expect(gaps?.run).toContain('|| true');
+    expect(getWorkflowStep(jobId, 'Upload coverage gap report')?.with).toMatchObject({
+      name: `coverage-gaps-${workspace}`,
+      path: `.coverage-gaps.${workspace}.json`,
+    });
+    // Gap reports are dotfiles; upload-artifact skips hidden files by default.
+    expect(getWorkflowStep(jobId, 'Upload coverage gap report')?.with).toMatchObject({
+      'include-hidden-files': true,
+    });
+  }
+});
+
+test('the aggregating job uploads the merged gap report including hidden files', () => {
+  expect(getWorkflowStep('test', 'Upload coverage gap report')?.with).toMatchObject({
+    name: 'coverage-gaps',
+    path: '.coverage-gaps.json',
+    'include-hidden-files': true,
+  });
+});
+
+test('the aggregating job merges shard coverage and fails closed on any shard result', () => {
+  const merge = getWorkflowStep('test', 'Merge coverage gap reports');
+  expect(merge?.if).toBe('always()');
+  expect(merge?.run).toContain('scripts/merge-coverage-gaps.mjs');
+  expect(merge?.run).toContain('.coverage-gaps.app.json');
+  expect(merge?.run).toContain('.coverage-gaps.ui.json');
+
+  const normalize = getWorkflowStep('test', 'Normalize coverage paths');
+  expect(normalize?.run).toBe('node scripts/prepare-codecov-reports.mjs');
+  expect(normalize?.if).toContain("needs.test-app.result == 'success'");
+  expect(normalize?.if).toContain("needs.test-ui.result == 'success'");
+
+  const gate = getWorkflowStep('test', 'Enforce shard results');
+  expect(gate?.if).toBe('always()');
+  for (const shard of ['test-repo', 'test-app', 'test-ui']) {
+    expect(gate?.env).toHaveProperty(
+      `RESULT_${shard.replace('-', '_').toUpperCase()}`,
+      `\${{ needs.${shard}.result }}`,
+    );
+  }
+  expect(gate?.run).toContain('success');
+  expect(gate?.run).toContain('exit 1');
+
+  // Codecov upload stays advisory.
+  for (const name of ['Upload app coverage to Codecov', 'Upload ui coverage to Codecov']) {
+    expect(getWorkflowStep('test', name)?.['continue-on-error']).toBe(true);
+  }
+});

.github/tests/closing-keywords-guard-workflow.test.ts

@@ -0,0 +1,36 @@
+import { fileURLToPath } from 'node:url';
+
+import { loadWorkflow } from './workflow-test-utils';
+
+const workflowPath = fileURLToPath(
+  new URL('../workflows/closing-keywords-guard.yml', import.meta.url),
+);
+
+test('closing keywords guard runs on PRs into main and re-runs when the body is edited', () => {
+  const workflow = loadWorkflow(workflowPath);
+  const pullRequest = (workflow.on as Record<string, { branches?: string[]; types?: string[] }>)
+    .pull_request;
+  expect(pullRequest.branches).toStrictEqual(['main']);
+  expect(pullRequest.types).toContain('edited');
+});
+
+test('closing keywords guard passes the PR text through env, not interpolation', () => {
+  const steps = loadWorkflow(workflowPath).jobs?.['closing-keywords']?.steps ?? [];
+  const guard = steps.find((step) => step.run?.includes('scripts/closing-keywords.mjs'));
+  expect(guard).toBeDefined();
+  expect(guard?.env?.PR_TITLE).toBe('${{ github.event.pull_request.title }}');
+  expect(guard?.env?.PR_BODY).toBe('${{ github.event.pull_request.body }}');
+  expect(guard?.run).not.toContain('${{');
+});
+
+test('closing keywords guard also scans the commit messages that build the squash message', () => {
+  const steps = loadWorkflow(workflowPath).jobs?.['closing-keywords']?.steps ?? [];
+  const checkout = steps.find((step) => step.uses?.startsWith('actions/checkout@'));
+  expect(checkout?.with?.['fetch-depth']).toBe(0);
+  const guard = steps.find((step) => step.run?.includes('scripts/closing-keywords.mjs'));
+  expect(guard?.env?.BASE_SHA).toBe('${{ github.event.pull_request.base.sha }}');
+  expect(guard?.env?.HEAD_SHA).toBe('${{ github.event.pull_request.head.sha }}');
+  expect(guard?.run).toContain('git log --format=%B "${BASE_SHA}..${HEAD_SHA}"');
+  expect(guard?.run).toContain('PR commits=');
+  expect(guard?.run).not.toContain('${{');
+});

.github/tests/harden-runner-workflow.test.ts

@@ -21,6 +21,9 @@ const expectedPolicy: Record<string, EgressPolicy> = {
   'ci-verify.yml/secrets': 'block',
   'ci-verify.yml/fuzz': 'block',
   'ci-verify.yml/test': 'block',
+  'ci-verify.yml/test-repo': 'block',
+  'ci-verify.yml/test-app': 'block',
+  'ci-verify.yml/test-ui': 'block',
   'ci-verify.yml/web': 'block',
   'ci-verify.yml/grype-image': 'block',
   // Required-context rename mirrors. They run one `test` against a `needs`

.github/tests/readme-translations.test.ts

@@ -103,7 +103,7 @@ describe.each(translatedReadmes)('%s', (readme) => {
 
   test('carries the security and SQLite RC migration warnings', () => {
     expect(content.match(/^> \[!WARNING\]$/gm)).toHaveLength(2);
-    expect(content).toContain('1.8.0-rc.3');
+    expect(content).toContain('1.8.0-rc.4');
     expect(content).toContain('SQLite');
     expect(content).toContain('`401`');
     expect(content).toContain('`503`');