Skip to content

ci: add the Node 18 smoke test that 5409a84 left missing - #240

Merged
Raftersecurity merged 1 commit into
mainfrom
ci/node18-smoke-rebased
Sep 9, 2026
Merged

ci: add the Node 18 smoke test that 5409a84 left missing#240
Raftersecurity merged 1 commit into
mainfrom
ci/node18-smoke-rebased

Conversation

@Rome-1

@Rome-1 Rome-1 commented Sep 9, 2026

Copy link
Copy Markdown
Collaborator

Replaces #239, which went CONFLICTING when the matrix removal landed on main directly as 5409a84. Same content minus the now-redundant matrix edit. (I could not force-push #239's branch — force-push is denied in my session — so this is a fresh branch rather than a rebase in place. #239 should be closed as superseded.)

Not part of the 0.10.1 release. #237 should merge first: it is 31/31 green and closes a bypass live in published 0.10.0 today. This adds coverage, not a fix, and holding a verified security release to add a test would be the wrong trade.

Why it is still needed

5409a84 dropped Node 18 from the vitest matrix, which was right — vitest 4 declares engines ^20 || ^22 || >=24 and cannot run there, so that leg exercised the runner's unsupported path and reported on neither it nor the product.

But it left no replacement. main currently ships engines >=18 with zero Node 18 signal. A support claim nothing checks is a claim, not a guarantee.

What this does

Runs what a Node 18 user runs: built on Node 20, run on Node 18, no test framework in the way — their situation exactly, since they install a prebuilt package rather than compiling one.

It asserts the rf-fuwy liveness probe both ways: a live gate yields its decision, an inert one yields none with a non-zero status. That second assertion is rf-fuwy — the whole defect was agent verify reporting a dead gate as healthy.

Measured before the job was written

Node 18.20.8 Node 24.14.0
shipped dist, exported runConfiguredHook, 200 iterations 200/200 read deny 200/200
raw spawnSync, isolated from vitest and TS, 350 each 0 failures 0 failures

Mutation-checked, in-tree so the import resolves

  • blank the live fixture → FAIL: probe read null, expected "deny"
  • make the inert fixture work → FAIL: an inert gate was not reported inert

My first attempt at this mutation was itself vacuous: the mutants exited 1 on a module-not-found rather than on the assertion, and I nearly recorded that as a pass.

Gated on run_core rather than the run that gates cross-platform — run_core is true on every PR, and a skipped job satisfies a required check.

5409a84 dropped Node 18 from the vitest matrix, which was right — vitest
4 declares engines ^20 || ^22 || >=24 and cannot run there, so that leg
was exercising the RUNNER's unsupported path and reporting on neither it
nor the product. But it left NO replacement, so main currently ships
engines >=18 with zero Node 18 signal. A support claim nothing checks is
a claim, not a guarantee.

This is the replacement, and it is all that remains of #239 after the
rebase — the matrix edit is already on main and is dropped here rather
than re-applied.

It runs what a Node 18 USER runs: built on Node 20, RUN on Node 18, no
test framework in the way. That is their situation exactly, since they
install a prebuilt package rather than compiling one.

It asserts the rf-fuwy liveness probe BOTH ways — a live gate yields its
decision, an inert one yields none with a non-zero status. The second
assertion IS rf-fuwy: the whole defect was `agent verify` reporting a
dead gate as healthy.

Measured before the job was written, not after:
    shipped dist, exported runConfiguredHook, 200 iterations
        v18.20.8  200/200 read "deny"
        v24.14.0  200/200
    raw spawnSync, isolated from vitest and TS, 350 each
        0 failures on either version, byte-identical results

Mutation-checked in both directions, in-tree so the import resolves:
blanking the live fixture gives `FAIL: probe read null, expected "deny"`;
making the inert fixture work gives `FAIL: an inert gate was not reported
inert`. My first attempt at this mutation was itself vacuous — the
mutants exited 1 on a module-not-found rather than on the assertion, and
I nearly recorded that as a pass.

Gated on run_core rather than the `run` that gates cross-platform:
run_core is true on every PR, and a skipped job satisfies a required
check, so coverage that only sometimes runs can be absent exactly when it
matters.
@Raftersecurity
Raftersecurity merged commit 4eb3c93 into main Sep 9, 2026
10 checks passed
@Raftersecurity
Raftersecurity deleted the ci/node18-smoke-rebased branch September 9, 2026 01:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants