Skip to content

test: run the release's tarball check on a valid, a wrong and an extra file - #6

Merged
neeo merged 2 commits into
mainfrom
APT-6290-release-check-rejection-tests
Oct 21, 2026
Merged

neeo merged 2 commits into
mainfrom
APT-6290-release-check-rejection-tests

Conversation

@neeo

@neeo neeo commented Oct 20, 2026 •

Copy link
Copy Markdown
Contributor

Follow-up to #5 (P3 from its delta review).

test/release-workflow.test.ts checked that the publish job's tarball check contains the right commands and comparisons, but not that a failed check stops the job: replacing every exit 1 in the workflow with : still passed all tests.

The test now extracts the check step's script from release.yml and runs it with bash -e in a temporary directory with a release directory, the way the runner does:

  • the valid tarball: exit 0, and TARBALL and SHA512 appended to GITHUB_ENV;
  • a wrong digest, an extra file, an extra hidden file, a missing tarball, and tarball names that are not file names (a path, a command substitution, no .tgz, a leading dash, empty): exit 1, an ::error:: line, and nothing appended to GITHUB_ENV.

On a machine whose base64 has no -w0 (macOS) the test puts a shim for it on PATH; on the runner GNU's is used as it is.

Verified: pnpm typecheck, pnpm test and pnpm check:package pass. With every exit 1 replaced by : ten of the new tests fail; with ls -A changed to ls the hidden-file test fails.

Summary by CodeRabbit

  • Tests
    • Expanded release validation coverage across platforms.
    • Added checks for tarball integrity, expected file contents, missing or unexpected files, and invalid archive names.
    • Verified correct handling of published tarball paths and SHA-512 checksums.

…a file

The publish job's check was tested only for the substrings it holds, so
replacing every exit 1 with : still passed. The test now runs the step's
script in a temporary directory: the valid tarball exits 0 and sets TARBALL
and SHA512, a wrong digest, an extra or hidden file, a missing tarball and a
tarball name that is not a file name exit 1 and set nothing.
@coderabbitai

coderabbitai Bot commented Oct 20, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: e8f45254-6bfa-4777-ac28-df9e6fa39f46
📥 Commits

Reviewing files that changed from the base of the PR and between 5423ed9 and bcf4161.

📒 Files selected for processing: 1
  • test/release-workflow.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The release workflow tests now run the publish-job tarball verification script in an isolated temporary directory. They check successful artifact handling and rejection of invalid tarball contents and names.

Changes: Tarball validation tests

Layer / File(s) Summary
Isolated tarball-check harness
test/release-workflow.test.ts
The tests add temporary-directory setup, cross-platform base64 support, SHA-512 generation, and execution of the publish validation script with captured results.
Tarball validation cases
test/release-workflow.test.ts
The tests check valid artifact handling and rejection of hash mismatches, extra files, unexpected or missing tarballs, and unsafe or invalid names.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to bcf41

The tarball-validation tests exercise the workflow’s actual check. No merge-blocking issue was identified; merge after normal checks.

Pre-merge checks: Passed 4 · Failed 1

Failed Failed checks: 1 warning

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed Passed checks: 4 passed
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title accurately identifies the main change: testing the release tarball-check script with valid, incorrect, and extra files. It omits some covered cases, such as hidden, missing, and invalidly na…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Title check

Explanation

The title accurately identifies the main change: testing the release tarball-check script with valid, incorrect, and extra files. It omits some covered cases, such as hidden, missing, and invalidly named tarballs, but the title does not need to list every test case.

✨ Finishing Touches: 💡 1
📝 Generate docstrings: 💡
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

The shim directory sat in the list the first test's afterEach empties, so
later tarball checks put a deleted directory on PATH and failed on hosts
whose base64 rejects -w0. It is now removed in afterAll, apart from the
per-test directories.
@neeo
neeo marked this pull request as ready for review October 20, 2026 23:03
@Pengbl0m

Copy link
Copy Markdown

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Oct 20, 2026 •

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@neeo
neeo merged commit 0e4dbfa into main Oct 21, 2026
2 checks passed
@neeo
neeo deleted the APT-6290-release-check-rejection-tests branch October 21, 2026 00:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants