chore: add fast-check dev dependency for property-based testing - #120
Conversation
Maintainer-approved dev-only dep (fast-check 4.9.0) enabling the fast-check-testing skill's PBT layer — no runtime code imports it. - AGENTS.md approved-deps gate updated (fast-check dev; the @fast-check/vitest connector stays optional/unapproved). - fast-check-testing skill's moderaty-context adoption note updated to match. - Verified with a scratch property suite (not committed): fast-check runs under the repo vitest config, and a crypto round-trip property (decrypt(encrypt(x)) === x over generated strings) passes against the real crypto.ts.
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
✅ Deploy Preview for moderaty ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Warning Review limit reached
Next review available in: 22 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
codeant-ai
Bot
added
the
size:M
Sequence DiagramThis PR approves and installs fast-check as a development-only dependency, enabling future property-based tests without changing runtime behavior. The verification flow confirms it works with the existing test suite. sequenceDiagram
participant Maintainer
participant Project
participant Test Suite
Maintainer->>Project: Approve fast-check for development use
Project->>Project: Install fast-check
Test Suite->>Project: Load property-testing support
Test Suite->>Test Suite: Verify crypto round-trip property
Generated by CodeAnt AI |
PR Summary by QodoAdd fast-check as approved dev dependency for property-based testing
AI Description
Diagram
High-Level Assessment
Files changed (4)
|
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| Security | 1 high |
🟢 Metrics 0 complexity · 0 duplication
Metric Results Complexity ✅ 0 (≤ 100 complexity) Duplication ✅ 0 (≤ 1 duplication)
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR correctly adds fast-check as a dev dependency with appropriate documentation updates. All changes are consistent and properly scoped. No defects found that block merge.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
Code Review by Qodo
1. Unapproved fast-check devDependency
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| "@sveltejs/kit": "^2.63.0", | ||
| "@sveltejs/vite-plugin-svelte": "^7.1.2", | ||
| "drizzle-kit": "^0.31.10", | ||
| "fast-check": "^4.9.0", |
There was a problem hiding this comment.
1. Unapproved fast-check devdependency 📘 Rule violation § Compliance
fast-check was added to devDependencies, but it is not in the compliance-approved dependency allowlist. This introduces an unapproved third-party package and increases supply-chain risk relative to the stated dependency restrictions.
Agent Prompt
## Issue description
The PR adds `fast-check` to `devDependencies`, but the compliance allowlist rule only permits a fixed set of runtime and dev dependencies.
## Issue Context
This repository has a compliance control that restricts which packages may appear in `dependencies`/`devDependencies`. Adding `fast-check` violates that allowlist unless the policy/rule is updated via an approved exception process.
## Fix Focus Areas
- package.json[27-27]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
1 participant
User description
Summary
Installs
fast-check@^4.9.0as a dev-only dependency — the maintainer approval the fast-check-testing skill's adoption gate required before any code imports it. No source changes; nothing at runtime imports it.This unblocks property-based testing batches per the skill's
references/moderaty-context.mdproperty catalog (I1–I13 mapped to properties: tenant isolation, idempotent ingest, dry-run no-durable-writes, crypto round-trips, …).Changes
package.json/package-lock.json:fast-checkdevDependency (4.9.0). The@fast-check/vitestconnector is deliberately NOT installed — plainfc.assertin vitest tests is the house style.AGENTS.md: approved-deps gate updated (fast-check added to the dev list with its conditions)..agents/skills-src/fast-check-testing/references/moderaty-context.md: adoption-gate note updated to match (installed copy of the skill will be re-synced after merge, per the edit-source-then-re-copy convention).Verification
decrypt(encrypt(x)) === xheld for generated strings (maxLength 1000) against the realcrypto.ts.npm run check: 0 errors, 0 warningsnpm run test: 949/949 greennpm run build: clean (adapter-netlify)CodeAnt-AI Description
Add approved property-based testing support for the development workflow
What Changed
Impact
✅ Broader automated test coverage✅ Safer validation of edge cases✅ No new runtime dependency💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.