Conversation
The Release and Publish workflow runs `npm run build:ci` (publish.yml build_command), but package.json defined no such script, so the publish job's build step failed with "Missing script: build:ci" and v1.1.0 never published to npm. git-embedded is pure ESM with no build, so build:ci is a no-op matching the `echo '✓ no build step'` that ci.yml already passes as its own build_command.
The coverage-badge job's coverage_command runs `npm run ci:coverage`, which was undefined. Add it as `npm run coverage` (the CLDMV convention, same as @cldmv/slothlet) — it runs vitest coverage, and the vitest config's json-summary reporter emits coverage/coverage-summary.json (the path the badge job reads). Verified: `npm run ci:coverage` exits 0 and writes coverage/coverage-summary.json.
git-embedded is a dynamic slothlet-composed API — self.* / context.* resolve at runtime, so tsc can't statically type that surface. slothlet's typegen only emits an all-`any` structural interface (verified on 3.7.0 and 3.12.1, fast and strict — autocomplete, not types), a real checkJs pass is ~260 untypeable dynamic-API errors, and a checkJs:false declaration emit has no teeth (it silently accepts a bogus JSDoc type). There is no meaningful JS type-check to run here; ESLint is the static-analysis net. skip_type_check: true resolves the coverage-badge job's reference to the (intentionally absent) test:types script.
## 🚀 What's Changed ### 💥 Breaking Changes _No breaking changes_ ### ✨ Features _No new features_ ### 🐛 Bug Fixes - fix(ci): add ci:coverage script (#14) (62bbfa2) - fix(ci): add missing build:ci script (#14) (f89f8ed) ### 📦 Dependencies _No dependency updates_ ### 🔧 Other Changes - ci: skip the type-check step (#14) (a1a638d) <details> <summary>👥 Contributors</summary> - @Shinrai </details>
cldmv-bot
Bot
added
! release → master
Contributor
Author
Dependency ReviewThe following issues were found:
License Issues.github/workflows/cla.yml
.github/workflows/release-notify.yml
.github/workflows/scorecard.yml
OpenSSF Scorecard
Scanned Files
|
… examples These 18 workflow files were bootstrapped from CLDMV/.github's example templates but never had their @Project/@filename header stamps updated to point at this repo - they still read @cldmv/.github and the example's own examples/individual-repo-workflows/<category>/ path. Correct them to self-reference @cldmv/git-embedded and this repo's actual .github/workflows/ path, matching the convention already used in fix-headers and slothlet.
This repo publishes to npm the same as fix-headers and slothlet, but was missing three workflows both of those have: CLA signing, release-announcement webhooks, and OpenSSF Scorecard. Add all three, matching the current templates - scorecard.yml already carries the job-scoped permissions fix (workflow-level permissions trip scorecard-action's own publish-time verification).
A single `vitest run --coverage` holds coverage data for the whole suite in one process and OOMs as the suite grows. Route `test` and `coverage` through @cldmv/vitest-runner (the same runner @cldmv/slothlet uses): it spawns each test file in its own child process and, under coverage, uses a blob-per-file + `--mergeReports` strategy so no single process holds the full dataset. - add tests/run-vitest.mjs wrapper (points the runner at the `*.test.mjs` convention + .configs/vitest.config.mjs) - test → `node tests/run-vitest.mjs`; coverage → `--coverage-quiet` - gitignore coverage/ + .vitest-coverage-blobs/ Baseline coverage established: ~36% lines. Tests to raise it follow.
…ll/link, helpers) Adds seven focused test files covering the previously-untested surface: - commander-help: the CLI help formatter (0.5% → ~99%) - cli-provisioning / cli-hooks: the restore/record/export/sync + install/ uninstall/template/version/doctor/init command wrappers - detect-hooks: the run/lefthook/pre-commit/simple-git-hooks detectors - install-link: install dispatcher/template + link batch/copy-executable - helpers: git/paths/report/log/messages helpers - embedded-topup: extra branches for the embedded engines All driven with real temp git-repo fixtures (the house style), each file self-verified, and the whole suite runs green together via the OOM-safe @cldmv/vitest-runner. Overall: lines 36.0% → 72.7%, statements 34.2% → 73.0%, functions 30.7% → 79.5%, branches 29.3% → 62.7%.
src/api/link/elevate-windows.mjs and src/lib/elevate-windows-child.mjs are Windows-only (UAC elevation via a detached child) and cannot execute on the Linux coverage runner, so they only drag the metric down with unreachable lines. Exclude them so coverage reflects the code that can actually run in CI.
Composition-loaded api leaves under-reported (~20% floor): slothlet, as an externalized dependency, imports each leaf via a native `import(leaf?slothlet_instance=<id>)` that never enters vitest's module graph, so v8 could not attribute the leaf function bodies. Inlining slothlet (test.server.deps.inline) routes those imports through the test runner — that alone moved the suite 75% -> 92% with no test changes. Targeted tests (cli/embedded/detect/link/root coverage suites, 127 tests) close the remaining real gaps to 100% lines/statements/functions/branches. Genuinely-unreachable defensive fallback operands (git writes errors to stderr so `|| stdout` is dead; `err.code || err.message`; `status || 1`; post-clone-success arms) are marked /* v8 ignore */, each with the reachable arm covered by a real test. Refs CLDMV/slothlet#217 (documents the inline requirement for consumers).
…sage nit The wrapper treated every non-flag token as a test pattern, so a value-taking Vitest flag like `--reporter verbose` misclassified its value as a pattern. Add a `--` delimiter: args before it are forwarded to Vitest, args after it are test patterns. Backward-compatible — without a `--`, the existing heuristic (non-flag = pattern, flag = forwarded) is unchanged. Also adds the missing space before the `--coverage-quiet` Usage comment and documents the delimiter. Addresses Copilot review on PR #17 (tests/run-vitest.mjs).
…ot impossible The `|| 1` fallbacks on git clone/add exit codes guard a genuine case: spawnSync returns a null status on spawn failure (git not on PATH) or signal termination. The prior comments wrongly claimed a normal run "cannot produce" it. Reword to state the case can occur (the reason for the guard) but isn't reproducible in the suite, so it's ignored rather than tested. Addresses Copilot review on PR #17 (src/api/cli/link.mjs:69,76).
Swept the remaining ignore comments the coverage work added: 14 (across init/install-hooks/restore/sync/report) claimed a git/spawn/network op "cannot fail" or was "unreachable" when it is in fact reachable — a spawn null status (git not on PATH / signal kill), an empty-stderr failure, a mid-call network drop. These are legitimate defensive guards for real conditions the suite can't reproduce, so they now say the case can occur but isn't reproducible in-suite, rather than claiming it can't happen. Left as-is: the genuinely-unreachable guards (fs errors always carry .code; git's fixed plumbing output format; regex/call-site logic). Comment-only — pragmas untouched, coverage still 100%. Follow-up to Copilot's PR #17 note on src/api/cli/link.mjs (same class of comment).
…erage run-vitest.mjs: an unset/invalid/non-positive VITEST_WORKERS no longer passes NaN/0/negative through to the runner — it validates parseInt via Number.isInteger && > 0 and falls back to 4. cli-coverage.test.mjs: the hermetic-git GIT_CONFIG_GLOBAL/SYSTEM now use `os.platform() === "win32" ? "NUL" : "/dev/null"`, matching the 12 other test files (it was the only one hardcoding /dev/null, non-hermetic on Windows). Addresses Copilot review on PR #17.
cldmv-bot
Bot
added
area: core
Shinrai
approved these changes
Jul 20, 2026
Shinrai
enabled auto-merge (squash)
July 20, 2026 04:26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚀 What's Changed
💥 Breaking Changes
No breaking changes
✨ Features
No new features
🐛 Bug Fixes
fix: self-reference workflow headers instead of pointing at .github's examples #16
fix(ci): add missing build:ci script #14
📦 Dependencies
No dependency updates
🔧 Other Changes
docs: correct v8-ignore comments — null spawn status is real, not impossible #17
--delimiter for forwarded Vitest args; fix Usage nit (32b1838)fix: self-reference workflow headers instead of pointing at .github's examples #16
fix(ci): add missing build:ci script #14
👥 Contributors
Avg: 100.0% ·
a6a18a9· Node lts/*