Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion tests/ci-workflows.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -163,7 +163,8 @@ describe("GitHub Actions hardening", () => {
// the runner's disk and the suite passes against a tree that no longer
// exists in git.
const winSteps = (ci.jobs?.["platform-windows"] as { steps?: { if?: string; run?: string }[] })?.steps ?? [];
expect(winSteps.some(step => step.run?.includes(`--shard=\${{ matrix.shard }}/${windowsShards.length}`))).toBe(true);
expect(winSteps.some(step => step.run?.includes("bun test --isolate tests")
&& step.run.includes(`--shard=\${{ matrix.shard }}/${windowsShards.length}`))).toBe(true);
Comment on lines +166 to +167

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Require an actual test invocation instead of substrings

This still does not ensure that the Windows step executes the test suite: a no-op such as run: echo bun test --isolate tests --shard=${{ matrix.shard }}/4 satisfies both includes checks while running no tests. Since the change is specifically intended to prevent a no-op or unrelated command from passing this hardening test, match the executable command itself—for example, by normalizing the script and requiring an anchored command line—rather than merely requiring both strings in the same run value.

Useful? React with 👍 / 👎.

expect(winSteps.some(step => step.if === "runner.environment == 'self-hosted'"
&& step.run?.includes("git clean -xffd"))).toBe(true);

Expand Down
Loading