mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-10-26 21:36:54 +09:00
rUvandr
663c58a091
* fix(ci): add live-registry audit for unpublished leaf pins (#4303) audit-wrapper-dep-ranges.mjs and audit-leaf-package-publish.mjs only check that a non-bundled @claude-flow/* leaf's CLI pin agrees with the workspace's own version. Neither asks npm whether that version was ever published. #4279 bumped @claude-flow/memory to 3.0.6 in the workspace and pinned the CLI to match; both existing audits were green since workspace and pin agreed with each other, but the standalone `npm publish` for memory was never run. 3.57.2 shipped depending on a version of memory that did not exist, breaking every fresh install with ETARGET. Add audit-leaf-versions-published.mjs, which queries the live npm registry for each non-bundled leaf and fails if the version the CLI's pin resolves to was never published. Wired into the plugin-package-audit CI job (same gate as the two existing leaf audits) and documented as a required pre-tag step in CLAUDE.md's publishing rules. Co-Authored-By: RuFlo <ruv@ruv.net> * fix: use encodeURIComponent instead of a first-occurrence .replace for the registry URL CodeQL flagged name.replace('@', '%40') as incomplete string escaping — String.replace with a string pattern only touches the first match. It happened to be harmless for npm scope names (exactly one leading @), but it's the wrong tool for escaping a URL path segment. encodeURIComponent also correctly escapes the scope separator (%2F), verified against the live registry (200 OK for @claude-flow/memory). Co-Authored-By: RuFlo <ruv@ruv.net> * fix(ci): baseline the new audit test file like its plain-script sibling scripts/__tests__/audit-leaf-versions-published.test.mjs is a bare Node script (console.log + node:assert/strict), the same shape as the already-baselined scripts/__tests__/audit-supply-chain.test.mjs — it has no vitest-discoverable describe/it block, so the root vitest ratchet reports "No test suite found in file" and fails CI's Test Suite job. This is not a real regression: the file was never runnable by vitest in the first place (same category as its sibling, which IS correctly listed here already). The test itself passes fine when run directly via `node scripts/__tests__/audit-leaf-versions-published.test.mjs` (6/6, see the PR description). Co-Authored-By: RuFlo <ruv@ruv.net> --------- Co-authored-by: r <r@x>