test: remove workflow string checks and strengthen provider assertions (#33017)

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

config/scripts/replace-cached-nsis-elevate.test.mjs

@@ -11,7 +11,6 @@ import {
 import { tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { parse } from 'yaml'
 
 import {
   findCachedElevatePaths,
@@ -319,45 +318,3 @@ describe('a cached elevate.exe miss is not silent', () => {
     expect(readFileSync(join(nsisDir, 'elevate.exe'), 'utf8')).toBe('signpath-signed-elevate')
   })
 })
-
-describe('release-cut.yml swaps the cached elevate.exe through the resolver', () => {
-  function swapStep() {
-    const workflow = parse(
-      readFileSync(join(projectRoot, '.github/workflows/release-cut.yml'), 'utf8')
-    )
-    const step = workflow.jobs.build.steps.find(
-      (candidate) => candidate.name === 'Replace cached elevate.exe with the signed copy'
-    )
-    expect(step).toBeDefined()
-    return step
-  }
-
-  it('delegates the cache lookup to the script instead of an inline path', () => {
-    const step = swapStep()
-    expect(step.run).toContain('node config/scripts/replace-cached-nsis-elevate.mjs $signed')
-    // The hardcoded miss that shipped v1.4.193/v1.4.194 unsigned.
-    expect(step.run).not.toContain('electron-builder\\Cache\\nsis')
-    expect(step.run).not.toContain('-ErrorAction SilentlyContinue')
-  })
-
-  it('fails the step when the swap reports a miss', () => {
-    const step = swapStep()
-    // Matched as an executed statement: downgrading this to a Write-Host restores
-    // the silent fail-open that let the unsigned helper ship.
-    expect(step.run).toMatch(/if \(\$LASTEXITCODE -ne 0\) \{/)
-    expect(step.run).toMatch(/^\s*throw \$message\s*$/m)
-    expect(step.run).toContain('GITHUB_STEP_SUMMARY')
-  })
-
-  // Why kept: windows-signing-rehearsal.yml shares the electron-builder-win-<hash>
-  // cache key, so dropping this guard would let a test certificate reach a release cache.
-  it('still refuses to stage anything but a SignPath-signed helper', () => {
-    const step = swapStep()
-    expect(step.run).toContain("$signature.Status -ne 'Valid'")
-    expect(step.run).toContain("$subject -notlike '*CN=SignPath Foundation*'")
-  })
-
-  it('blocks the release when the cache swap fails', () => {
-    expect(swapStep()['continue-on-error']).toBeUndefined()
-  })
-})

config/scripts/space-sharing-copy.test.ts

@@ -14,8 +14,6 @@ import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import {
-  LINUX_REFLINK_ARGS,
-  MACOS_CLONE_ARGS,
   copyPrivateTree,
   hardlinkTree,
   makeTreeReadOnly,
@@ -56,7 +54,7 @@ describe('asynchronous immutable sharing', () => {
     expect(readlinkSync(path.join(destination, 'relative-link'))).toBe(path.join('nested', 'file'))
   })
 
-  it('keeps the event loop available while a sharing process is pending', async () => {
+  it('waits for the asynchronous sharing mechanism to finish', async () => {
     const { root, source } = makeTree()
     let finish!: () => void
     const pending = new Promise<void>((resolve) => {
@@ -155,9 +153,48 @@ describe('shareTree', () => {
     )
   })
 
-  it('fails loudly instead of degrading, on both copy-out mechanisms', () => {
-    expect(MACOS_CLONE_ARGS).toContain('-P')
-    expect(LINUX_REFLINK_ARGS).toContain('--reflink=always')
+  it('uses strict native-copy arguments and handles their failures', async () => {
+    const nativeCopy = vi.fn(() => {
+      throw new Error('native storage sharing unavailable')
+    })
+    vi.doMock('node:child_process', () => ({ execFileSync: nativeCopy }))
+    vi.resetModules()
+    try {
+      const { shareTree: shareWithNativeCopy } = await import('./space-sharing-copy.mjs')
+      const { root, source } = makeTree()
+      const cloneDestination = path.join(root, 'clone')
+      expect(() => shareWithNativeCopy(source, cloneDestination, { platform: 'darwin' })).toThrow(
+        /Could not share storage/
+      )
+      expect(existsSync(cloneDestination)).toBe(false)
+      expect(nativeCopy).toHaveBeenNthCalledWith(
+        1,
+        '/bin/cp',
+        ['-c', '-R', '-P', source, cloneDestination],
+        { stdio: 'ignore' }
+      )
+
+      const reflinkDestination = path.join(root, 'reflink')
+      expect(shareWithNativeCopy(source, reflinkDestination, { platform: 'linux' })).toBe(
+        'hardlink'
+      )
+      expect(nativeCopy).toHaveBeenNthCalledWith(
+        2,
+        'cp',
+        ['--reflink=always', '-a', source, reflinkDestination],
+        { stdio: 'ignore' }
+      )
+      expect(statSync(path.join(reflinkDestination, 'nested', 'file')).ino).toBe(
+        statSync(path.join(source, 'nested', 'file')).ino
+      )
+      expect(readFileSync(path.join(reflinkDestination, 'nested', 'file'), 'utf8')).toBe('contents')
+      expect(readlinkSync(path.join(reflinkDestination, 'relative-link'))).toBe(
+        path.join('nested', 'file')
+      )
+    } finally {
+      vi.doUnmock('node:child_process')
+      vi.resetModules()
+    }
   })
 })
 
@@ -217,6 +254,7 @@ describe('makeTreeReadOnly', () => {
       const { source } = makeTree()
       const executable = path.join(source, 'electron')
       writeFileSync(executable, 'binary', { mode: 0o755 })
+      chmodSync(executable, 0o755)
       makeTreeReadOnly(source)
       // Verified on real ext4: 0o555. Windows has no execute bit -- the read-only attribute does
       // not gate execution there, confirmed by running a read-only hardlinked .exe on NTFS.

config/scripts/vitest-sqlite-runtime-cache.test.ts

@@ -8,27 +8,32 @@ it('re-derives SQLite assignments from malformed disposable cache data', async (
     .update(readFileSync(new URL('./vitest-sqlite-runtime-scan.mjs', import.meta.url)))
     .digest('hex')
   for (const files of [null, { 'fixture.test.ts': [1, 2, 'false'] }]) {
-    vi.doMock('node:fs', async (original) => ({
-      ...(await original<typeof FileSystem>()),
-      globSync: () => ['fixture.test.ts'],
-      statSync: () => ({ mtimeMs: 1, size: 2 }),
-      readFileSync: (path: Parameters<typeof readFileSync>[0]) =>
-        String(path).endsWith('.json')
-          ? JSON.stringify({ version, files })
-          : String(path).endsWith('fixture.test.ts')
-            ? 'export {}'
-            : readFileSync(path),
-      mkdirSync: vi.fn(),
-      writeFileSync: vi.fn(),
-      renameSync: vi.fn()
-    }))
-    vi.resetModules()
-    try {
-      const { findSqliteRuntimeTests } = await import('./vitest-sqlite-runtime-scan.mjs')
-      expect(findSqliteRuntimeTests()).toEqual([])
-    } finally {
-      vi.doUnmock('node:fs')
+    for (const [source, expected] of [
+      ['export {}', []],
+      ["import './src/main/sqlite/sync-database'", ['fixture.test.ts']]
+    ] as const) {
+      vi.doMock('node:fs', async (original) => ({
+        ...(await original<typeof FileSystem>()),
+        globSync: () => ['fixture.test.ts'],
+        statSync: () => ({ mtimeMs: 1, size: 2 }),
+        readFileSync: (path: Parameters<typeof readFileSync>[0]) =>
+          String(path).endsWith('.json')
+            ? JSON.stringify({ version, files })
+            : String(path).endsWith('fixture.test.ts')
+              ? source
+              : readFileSync(path),
+        mkdirSync: vi.fn(),
+        writeFileSync: vi.fn(),
+        renameSync: vi.fn()
+      }))
       vi.resetModules()
+      try {
+        const { findSqliteRuntimeTests } = await import('./vitest-sqlite-runtime-scan.mjs')
+        expect(findSqliteRuntimeTests()).toEqual(expected)
+      } finally {
+        vi.doUnmock('node:fs')
+        vi.resetModules()
+      }
     }
   }
 })