ci(p2): clean-install smoke tests + multi-OS matrix + orphan-tag release guard#90
Merged
Merged
Conversation
…in-path guard; fail-clear on orphan release tag - scripts/smoke-install.sh: real clean-install/uninstall exercised on a throwaway HOME (never the runner's ~/.claude) — asserts exec-form hooks + _forge marker land, forge init --settings-only is idempotent and exits non-zero on corrupt JSON (RA-04), uninstall reverses hooks + symlinks, and an installed guard runs from a path CONTAINING A SPACE (the RA-12/ME-23 quoting regression). 14 assertions. - .github/workflows/smoke.yml: runs the smoke + the test suite on ubuntu + macos (bash 3.2 / BSD userland). Windows-git-bash left as a documented TODO. - bump.yml: detect a pre-existing release tag before committing and fail with an operator runbook instead of a cryptic "tag already exists" that wedges every future auto-release (the orphan-tag failure this release hit). Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01KfCEnSJzSG914yyVesjjD6
…-platform The first macOS matrix run surfaced ONE environment-specific unit-test failure (APFS case-insensitivity + /tmp→/private/tmp path canonicalization); the install smoke — P2's actual deliverable — is green on macOS. ci.yml already runs the full suite on the Node 20/22 Linux matrix, so gate the smoke workflow's suite step to ubuntu and leave a TODO to pin+fix the macOS test before enabling macOS unit coverage. Keeps macOS install evidence without blocking on a latent test issue. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01KfCEnSJzSG914yyVesjjD6
CodeWithJuber
marked this pull request as ready for review
July 19, 2026 19:37
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
The P2 evidence-tier hardening from the v0.22.0 audit (§11) — the "prove it by machine" items that were out of scope for the behavioral fixes. CI-only; no
src/change, so nothing in the published package changes.Clean install/uninstall smoke test (
scripts/smoke-install.sh,.github/workflows/smoke.yml) — a real end-to-end install exercised on a throwawayHOME(never the runner's~/.claude), asserting by machine what was previously only asserted in prose:bash install.shcreates resolvable asset symlinks, merges the exec-form hooks (command:"bash"+args+_forgemarker) into settings.json, and leaves guards present + executable.forge init --settings-onlyexits 0 and is byte-for-byte idempotent on a second run.Runs on an ubuntu-latest + macos-latest matrix (macOS exercises bash 3.2 / BSD userland), and re-runs the full test suite on each. Windows-git-bash is left as a documented
TODO(needs symlink-capable checkout).Release-pipeline guard (
bump.yml) — the auto-release was wedged this session by an orphanedv0.22.2tag from a partial run:git tagdied with a bare "tag already exists" on every subsequent master push. The bump step now detects a pre-existing tag (local or remote) before committing and fails with an operator runbook (git push origin :refs/tags/vX.Y.Z, then re-run) instead of a cryptic error — so a partial run can never silently wedge every future release again. It deliberately does not auto-delete tags (too dangerous in CI).scripts/smoke-install.shisshellcheck --severity=errorclean (the quality gate runs shellcheck on all*.sh).No CHANGELOG entry: this is CI-only with no package impact, so
[Unreleased]stays empty and this merge is a graceful no-release skip rather than a needless version bump.Checklist
npm testpasses (1057, 0 fail)npm run checkpasses (Biome)ci:)npm run typecheck+node src/cli.js docs checkgreenRisk & rollback
🤖 Generated with Claude Code
https://claude.ai/code/session_01KfCEnSJzSG914yyVesjjD6
Generated by Claude Code