diff --git a/.github/workflows/full-suite.yml b/.github/workflows/full-suite.yml index 286674c0d9..1859ef490e 100644 --- a/.github/workflows/full-suite.yml +++ b/.github/workflows/full-suite.yml @@ -20,6 +20,11 @@ concurrency: group: full-suite-${{ github.sha }} cancel-in-progress: false +# Least-privilege token: jobs only read the repo (checkout + cache) and upload +# workflow artifacts (timings), which needs no extra permission scope. +permissions: + contents: read + # FN-4863: Opt JavaScript actions into Node 24 ahead of GitHub's forced cutover on 2026-06-02. env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 1f4952c5fa..b8b75c6efd 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -21,6 +21,10 @@ concurrency: group: pr-checks-${{ github.ref }} cancel-in-progress: true +# Least-privilege token: every job here only reads the repo (checkout + cache). +permissions: + contents: read + # FN-4863: Opt JavaScript actions into Node 24 ahead of GitHub's forced cutover on 2026-06-02. env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" diff --git a/packages/cli/src/__tests__/root-test-command.test.ts b/packages/cli/src/__tests__/root-test-command.test.ts index 4a8972b0a7..80b594b1a5 100644 --- a/packages/cli/src/__tests__/root-test-command.test.ts +++ b/packages/cli/src/__tests__/root-test-command.test.ts @@ -3,7 +3,7 @@ import { decideExecutionPlan, normalizeForwardedArgs, resolveAffectedPackages, - shouldForceFullSuite, + isSharedInfraChange, } from "../../../../scripts/test-changed.mjs"; import { computeSplitPlan, parseShardArgs, planShardAssignments, selectShardPackages } from "../../../../scripts/ci-test-shard.mjs"; @@ -52,9 +52,9 @@ describe("root test command changed-only planning", () => { }); it("marks root workflow/config changes as shared-infra (gate-mode) triggers", () => { - expect(shouldForceFullSuite([".github/workflows/pr-checks.yml"])).toBe(true); - expect(shouldForceFullSuite(["package.json"])).toBe(true); - expect(shouldForceFullSuite(["packages/core/src/store.ts"])).toBe(false); + expect(isSharedInfraChange([".github/workflows/pr-checks.yml"])).toBe(true); + expect(isSharedInfraChange(["package.json"])).toBe(true); + expect(isSharedInfraChange(["packages/core/src/store.ts"])).toBe(false); }); it("strips forwarded silent flags so package vitest scripts do not receive duplicates", () => { diff --git a/scripts/__tests__/test-changed.test.mjs b/scripts/__tests__/test-changed.test.mjs index fd86cbdeeb..1aa9ff284f 100644 --- a/scripts/__tests__/test-changed.test.mjs +++ b/scripts/__tests__/test-changed.test.mjs @@ -10,7 +10,7 @@ import assert from "node:assert/strict"; import { buildPackageDirByName, buildReverseDependencyMap, - shouldForceFullSuite, + isSharedInfraChange, resolveAffectedPackages, decideExecutionPlan, computePackageHash, @@ -101,72 +101,72 @@ function hashWithFakeGit(pkgDir, blobSha) { } // --------------------------------------------------------------------------- -// shouldForceFullSuite +// isSharedInfraChange // --------------------------------------------------------------------------- -test("shouldForceFullSuite: returns false for pure package changes", () => { +test("isSharedInfraChange: returns false for pure package changes", () => { assert.equal( - shouldForceFullSuite(["packages/engine/src/foo.ts", "packages/core/src/bar.ts"]), + isSharedInfraChange(["packages/engine/src/foo.ts", "packages/core/src/bar.ts"]), false, ); }); -test("shouldForceFullSuite: returns true when pnpm-lock.yaml changed", () => { - assert.equal(shouldForceFullSuite(["pnpm-lock.yaml"]), true); +test("isSharedInfraChange: returns true when pnpm-lock.yaml changed", () => { + assert.equal(isSharedInfraChange(["pnpm-lock.yaml"]), true); }); -test("shouldForceFullSuite: returns true when scripts/test-changed.mjs changed", () => { - assert.equal(shouldForceFullSuite(["scripts/test-changed.mjs"]), true); +test("isSharedInfraChange: returns true when scripts/test-changed.mjs changed", () => { + assert.equal(isSharedInfraChange(["scripts/test-changed.mjs"]), true); }); -test("shouldForceFullSuite: returns true when scripts/check-test-isolation.mjs changed", () => { - assert.equal(shouldForceFullSuite(["scripts/check-test-isolation.mjs"]), true); +test("isSharedInfraChange: returns true when scripts/check-test-isolation.mjs changed", () => { + assert.equal(isSharedInfraChange(["scripts/check-test-isolation.mjs"]), true); }); -test("shouldForceFullSuite: returns true when a GitHub workflow changed", () => { - assert.equal(shouldForceFullSuite([".github/workflows/pr-checks.yml"]), true); +test("isSharedInfraChange: returns true when a GitHub workflow changed", () => { + assert.equal(isSharedInfraChange([".github/workflows/pr-checks.yml"]), true); }); -test("shouldForceFullSuite: returns false for .changeset/*.md summary files", () => { - assert.equal(shouldForceFullSuite([".changeset/fn-5157-test-changed-allowlist.md"]), false); +test("isSharedInfraChange: returns false for .changeset/*.md summary files", () => { + assert.equal(isSharedInfraChange([".changeset/fn-5157-test-changed-allowlist.md"]), false); }); -test("shouldForceFullSuite: still returns true for .changeset/config.json", () => { - assert.equal(shouldForceFullSuite([".changeset/config.json"]), true); +test("isSharedInfraChange: still returns true for .changeset/config.json", () => { + assert.equal(isSharedInfraChange([".changeset/config.json"]), true); }); -test("shouldForceFullSuite: returns false for allowlisted root markdown files", () => { +test("isSharedInfraChange: returns false for allowlisted root markdown files", () => { for (const file of ["AGENTS.md", "README.md", "CHANGELOG.md", "CONTRIBUTING.md", "SECURITY.md"]) { - assert.equal(shouldForceFullSuite([file]), false, `${file} should stay on changed-only mode`); + assert.equal(isSharedInfraChange([file]), false, `${file} should stay on changed-only mode`); } }); -test("shouldForceFullSuite: returns false for .fusion artifacts", () => { - assert.equal(shouldForceFullSuite([".fusion/memory/MEMORY.md"]), false); - assert.equal(shouldForceFullSuite([".fusion/tasks/FN-5157/PROMPT.md"]), false); +test("isSharedInfraChange: returns false for .fusion artifacts", () => { + assert.equal(isSharedInfraChange([".fusion/memory/MEMORY.md"]), false); + assert.equal(isSharedInfraChange([".fusion/tasks/FN-5157/PROMPT.md"]), false); }); -test("shouldForceFullSuite: still returns true for root config edges", () => { +test("isSharedInfraChange: still returns true for root config edges", () => { for (const file of ["tsconfig.json", ".npmrc", "Dockerfile"]) { - assert.equal(shouldForceFullSuite([file]), true, `${file} should still force the full suite`); + assert.equal(isSharedInfraChange([file]), true, `${file} should still force the full suite`); } }); -test("shouldForceFullSuite: mixed diff with only allowlisted root paths returns false", () => { +test("isSharedInfraChange: mixed diff with only allowlisted root paths returns false", () => { assert.equal( - shouldForceFullSuite(["AGENTS.md", ".changeset/foo.md", ".fusion/tasks/FN-5154/task.json"]), + isSharedInfraChange(["AGENTS.md", ".changeset/foo.md", ".fusion/tasks/FN-5154/task.json"]), false, ); }); -test("shouldForceFullSuite: mixed diff with allowlisted root path plus explicit trigger returns true", () => { - assert.equal(shouldForceFullSuite(["AGENTS.md", "pnpm-lock.yaml"]), true); +test("isSharedInfraChange: mixed diff with allowlisted root path plus explicit trigger returns true", () => { + assert.equal(isSharedInfraChange(["AGENTS.md", "pnpm-lock.yaml"]), true); }); -test("shouldForceFullSuite: FN-5157 reproduction keeps FN-5154 diff in changed-only mode", () => { +test("isSharedInfraChange: FN-5157 reproduction keeps FN-5154 diff in changed-only mode", () => { // FN-5157: AGENTS.md + changeset summaries previously tripped the root catch-all and forced a full suite for the FN-5154 diff. assert.equal( - shouldForceFullSuite([ + isSharedInfraChange([ "AGENTS.md", ".changeset/FN-5136-quick-entry-submit-lock.md", ".changeset/FN-5141-soft-delete-terminology.md", diff --git a/scripts/boot-smoke.mjs b/scripts/boot-smoke.mjs index 79940c9229..b854f0dfa9 100644 --- a/scripts/boot-smoke.mjs +++ b/scripts/boot-smoke.mjs @@ -40,6 +40,9 @@ const cliBin = path.join(repoRoot, "packages/cli/bin.mjs"); const HEALTH_TIMEOUT_MS = 60_000; const SHUTDOWN_TIMEOUT_MS = 15_000; +// Ephemeral-port TOCTOU: retry the whole boot with a fresh port when the +// child loses the bind race (EADDRINUSE). +const BOOT_ATTEMPTS = 3; function parsePortList(raw) { return String(raw ?? "") @@ -110,6 +113,36 @@ async function main() { console.log("boot-smoke: `fn --help` OK"); // 2. Real server boot on an ephemeral port with an isolated HOME. + // The ephemeral-port probe is inherently TOCTOU (probe closes before the + // server binds), so an EADDRINUSE loss on a busy machine retries with a + // fresh port instead of failing the gate. + let cleanup = () => {}; + process.on("exit", () => cleanup()); + // Node does NOT fire 'exit' on signals by default. A cancelled CI job + // (timeout, manual cancel, runner eviction) sends SIGTERM — without these + // handlers the serve child would be orphaned. + for (const sig of ["SIGTERM", "SIGINT"]) { + process.on(sig, () => { + cleanup(); + process.exit(sig === "SIGINT" ? 130 : 143); + }); + } + + for (let attempt = 1; attempt <= BOOT_ATTEMPTS; attempt++) { + const result = await bootAndVerify(attempt, (fn) => (cleanup = fn)); + if (result === "retry-port") continue; + console.log("boot-smoke: PASS"); + return; + } + fail(`could not bind a server port after ${BOOT_ATTEMPTS} attempts (EADDRINUSE each time)`); +} + +/** + * One boot attempt: spawn, poll health, verify SIGTERM shutdown. + * Returns "retry-port" when the child lost the ephemeral-port race + * (EADDRINUSE); calls fail() (which exits) on any real failure. + */ +async function bootAndVerify(attempt, registerCleanup) { const port = await getEphemeralPort(); const isolatedHome = mkdtempSync(path.join(tmpdir(), "fusion-boot-smoke-")); let stderrBuf = ""; @@ -132,7 +165,7 @@ async function main() { child.stderr.on("data", (d) => (stderrBuf += d)); child.stdout.on("data", (d) => (stderrBuf += d)); - const cleanup = () => { + registerCleanup(() => { // 'exit' handlers cannot await: escalate straight to SIGKILL so a child // that ignores SIGTERM is never orphaned holding the port/tmpdir. The // graceful SIGTERM path below runs before this on the success path. @@ -142,17 +175,7 @@ async function main() { // ESRCH: child already reaped between the check and the kill — fine. } rmSync(isolatedHome, { recursive: true, force: true }); - }; - process.on("exit", cleanup); - // Node does NOT fire 'exit' on signals by default. A cancelled CI job - // (timeout, manual cancel, runner eviction) sends SIGTERM — without these - // handlers the serve child would be orphaned. - for (const sig of ["SIGTERM", "SIGINT"]) { - process.on(sig, () => { - cleanup(); - process.exit(sig === "SIGINT" ? 130 : 143); - }); - } + }); const exitedEarly = new Promise((resolve) => { child.once("exit", (code, signal) => resolve({ code, signal })); @@ -166,16 +189,25 @@ async function main() { }), ]); } catch (err) { + if (/EADDRINUSE/.test(stderrBuf) && attempt < BOOT_ATTEMPTS) { + console.log(`boot-smoke: port :${port} lost to another process (EADDRINUSE), retrying with a fresh port (attempt ${attempt}/${BOOT_ATTEMPTS})`); + await exitedEarly; // child is already dead or dying; wait so cleanup is race-free + rmSync(isolatedHome, { recursive: true, force: true }); + return "retry-port"; + } fail(err.message, stderrBuf); } console.log(`boot-smoke: GET /api/health 200 on :${port}`); - // 3. Clean shutdown of OUR child only. + // 3. Clean shutdown of OUR child only. The verdict requires BOTH that + // SIGTERM was actually delivered (a server that died between the health + // check and here is a failure, not a pass) AND that the exit was clean + // (SIGTERM or exit code 0) — a crash after serving is a broken boot path. + let sigtermSent = false; try { - child.kill("SIGTERM"); + sigtermSent = child.kill("SIGTERM"); } catch { - // ESRCH: server exited between the health check and the kill — the - // exitedEarly promise below already carries its exit code. + // ESRCH: server already exited — sigtermSent stays false and fails below. } const { code, signal } = await Promise.race([ exitedEarly, @@ -183,12 +215,18 @@ async function main() { setTimeout(() => resolve({ code: null, signal: "timeout" }), SHUTDOWN_TIMEOUT_MS), ), ]); + if (!sigtermSent) { + fail(`server exited on its own after the health check (${code ?? `signal ${signal}`}) — SIGTERM shutdown could not be verified`, stderrBuf); + } if (signal === "timeout") { child.kill("SIGKILL"); fail("server did not shut down within 15s of SIGTERM", stderrBuf); } + if (signal !== "SIGTERM" && code !== 0) { + fail(`server exited uncleanly on SIGTERM (${code ?? `signal ${signal}`})`, stderrBuf); + } console.log(`boot-smoke: clean shutdown (${code ?? signal})`); - console.log("boot-smoke: PASS"); + return "ok"; } main().catch((err) => fail(err.message ?? String(err))); diff --git a/scripts/test-changed.mjs b/scripts/test-changed.mjs index 78567fdf72..59a07aa1ed 100644 --- a/scripts/test-changed.mjs +++ b/scripts/test-changed.mjs @@ -113,7 +113,7 @@ const HASH_VERSION_PREFIX = "v2"; * alone would miss those, so we fold the tree in globally — the simplest * provably-correct choice (mirrors the tsconfig.base.json treatment). * - * NOTE: this list intentionally overlaps `shouldForceFullSuite`'s + * NOTE: this list intentionally overlaps `isSharedInfraChange`'s * `fullSuitePaths` (which decides full-suite mode, a different axis than cache * busting). When adding a new shared root config input, consider both lists. */ @@ -428,12 +428,13 @@ function isTestIrrelevantRootPath(file) { return ["README", "CHANGELOG.md", "LICENSE", "LICENSE.md"].includes(file); } -export function shouldForceFullSuite(changedFiles) { +export function isSharedInfraChange(changedFiles) { // NOTE: overlaps SHARED_HASH_INPUT_PATHS by intent (different axis: this list // signals shared-infra changes; that one busts every package's cache hash). // When adding a new shared root config input, consider both lists. // - // HISTORY: this signal used to escalate `pnpm test` to an implicit full + // HISTORY: previously named `shouldForceFullSuite` — this signal used to + // escalate `pnpm test` to an implicit full // recursive run — which was the local OOM path (two concurrent heavy // packages, 6GB dashboard heaps). Since the merge-gate redesign // (docs/plans/2026-06-04-001-refactor-fast-trusted-test-gate-plan.md) it @@ -1026,7 +1027,7 @@ export function decideExecutionPlan({ if (!comparisonBase) return { mode: "gate", reason: "missing-comparison-base" }; if (!changedFiles) return { mode: "gate", reason: "diff-failed" }; if (changedFiles.length === 0) return { mode: "gate", reason: "no-changes" }; - if (shouldForceFullSuite(changedFiles)) return { mode: "gate", reason: "shared-infra-changed" }; + if (isSharedInfraChange(changedFiles)) return { mode: "gate", reason: "shared-infra-changed" }; const affectedPackages = resolveAffectedPackages(changedFiles, packageNameByDir); if (!affectedPackages || affectedPackages.length === 0) return { mode: "gate", reason: "no-affected-package" }; @@ -1234,7 +1235,10 @@ export function main(argv = process.argv.slice(2)) { // affected expansion preserves changed-code coverage. Overlap (engine in the // affected set re-runs the engine-core files) is accepted by design. console.log("[test-changed] running merge-gate suite (pnpm test:gate) before affected packages."); - run("pnpm", ["test:gate"], { env: isolatedHomeEnv }); + // Run the gate under the same isolation guard as the affected set — a gate + // suite leak must trip the checker, not silently become the "before" state + // of the later run. + runMaybeIsolated("pnpm", ["test:gate"], { env: isolatedHomeEnv }); const filterArgs = activePackages.flatMap((pkg) => ["--filter", pkg]); console.log(`[test-changed] running tests for changed packages: ${activePackages.join(", ")}`);