fix(ci): stabilize Windows tests, prod audit, and secret scan - #8
Merged
Conversation
added 5 commits
August 6, 2026 00:48
- Make path-dependent test assertions cross-platform: guard POSIX-only semantics with isWindows and build expectations with path.join so they match the source on Windows hosts - Override transitive deps hono@4.13.0 and ip-address@10.4.0 so npm audit --omit=dev reports 0 vulnerabilities - Replace the license-gated gitleaks GitHub Action with the open-source Gitleaks CLI (v8.30.1) run directly - Raise npm loglevel from silent to warn so CI failures stay visible
- derive expected SDK session paths via path.join + encodeVaultPathForSDK since path.resolve prepends the current drive letter on Windows hosts - allow a drive-letter prefix in encodeVaultPathForSDK expectations - use multi-letter segments in parsePathEntries/findConflictingPath fixtures because /a is a legitimate MSYS drive reference on Windows - expect host separators for non-existent env var normalization
The action fails without the repository Dependency graph, which requires org admin access to enable. New-dependency vulnerabilities remain gated by npm audit --omit=dev in ci.yml; the job definition is kept as a comment for easy restoration.
The action cannot pass until the repository Dependency graph is enabled, which needs org admin access. Keep the review running but non-blocking (continue-on-error); introduced vulnerabilities stay gated by npm audit --omit=dev in ci.yml. Remove continue-on-error to re-gate once the Dependency graph is enabled.
On Windows hosts the requested sidecar path uses backslashes, so the mock's forward-slash branch check missed it and returned the main session transcript, breaking the subagent hydration assertion.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification
npm run typechecknpm run lintnpm run testnpm run buildnpm run release:checknpm run audit:prodSafety
CHANGELOG.md