Skip to content

No CI: nothing runs npm test or npm run build on pull requests #13

Description

@bautrey

.github/workflows/ does not exist in this repo. gh pr checks 11 shows only CodeRabbit (a GitHub App), no test or build job. So a PR here is merged on whatever the author ran locally, and a consumer installing by tarball SHA gets a committed dist/ that no automation ever verified matches src/ — which is exactly the drift already sitting in packages/admin/dist (#12).

This is the auth client library for every Fortium app. It should be the last repo without a test gate, not the only one.

Minimum viable workflow (pull_request + push to main):

  1. npm ci
  2. npm run build — then git diff --exit-code -- packages/*/dist so a stale committed dist fails the run (closes the packages/admin/dist is stale relative to src — npm run build regenerates 16 files that were never committed #12 class permanently)
  3. npm test (the root script already sets --experimental-vm-modules)

Same shape as identity's deploy.yml test job minus the postgres service; ~30 lines. Add a required-status-check ruleset scoped to this repo (not the org-level one) once it is green.

Evidence for #11 today: npm test 14 suites / 187 tests exit 0 and npm run build exit 0 — locally, in the implementer's worktree, and nowhere else.

Refs #11, #12

Activity

  1. bautrey commented on Sep 2, 2026

    @bautrey
    ContributorAuthor

    Gateway hit the same gap and is fixing it there (gateway#140): they had no CI running lint, typecheck, test or build, and found five merged PRs that existed solely to green those gates by hand.

    Their framing for why it matters more here than in an app repo, which I agree with: a stale committed build artifact plus no CI is a combination that ships silently. Consumers of this package install by tarball SHA and get the committed dist/ — so if dist/ drifts from src/ (which it has: #12), nothing anywhere catches it. Every other Fortium repo at least fails a test run; this one has neither a test gate nor a build-parity gate, and it is the auth client for all of them.

    That makes the git diff --exit-code -- packages/*/dist step in the proposal above the load-bearing part, not a nicety — it closes #12's class permanently rather than fixing the one instance.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions