mirror of
https://github.com/stablyai/orca.git
synced 2026-09-22 00:02:31 +00:00
OrcaWinandOrca Worker
3ae51076b1
* fix(tooling): run oxlint gates without a Windows .cmd shim
`check:code-quality:changed` spawned `pnpm.cmd` without a shell, which Node
refuses under the CVE-2024-27980 mitigation, so the gate died with EINVAL
before linting anything. Resolve oxlint's own Node bin and run it under this
process's node instead — no shim, no shell, no quoting question — and add a
ratchet so the idiom cannot spread back into config/scripts.
* fix(tooling): validate the react-doctor diff base and widen the shim ratchet
`base` reaches cmd.exe unquoted on the shell fallback, so reject anything
outside a git revision before spawning. The ratchet matched only a handful of
runner names, which let `vitest.cmd` through even though config/scripts already
spawns vitest, playwright and electron-builder; match any batch-shim literal
instead, walk subdirectories, and cover tests/tools.
* docs(tooling): state what the shim ratchet and diff-base check miss
Both comments read as complete accounts of their guard's coverage. The revision
class rejects reflog syntax like HEAD@{1}, deliberately, since braces have no
business in a cmd.exe-bound argument; the ratchet misses a drive-lettered
literal because a colon is not in its class. Say so beside the template-literal
ceiling already noted.
---------
Co-authored-by: Orca Worker <orca-worker@localhost>
49 lines
1.7 KiB
JavaScript
49 lines
1.7 KiB
JavaScript
import { spawnSync } from 'node:child_process'
|
|
import { mkdtempSync, writeFileSync } from 'node:fs'
|
|
import { tmpdir } from 'node:os'
|
|
import path from 'node:path'
|
|
import { describe, expect, it } from 'vitest'
|
|
import { resolveOxlintInvocation } from './oxlint-cli-invocation.mjs'
|
|
|
|
const pluginPath = path.resolve('config/oxlint-plugins/mobile-pairing-qrcode-import.mjs')
|
|
const oxlint = resolveOxlintInvocation()
|
|
|
|
function lintSource(source) {
|
|
const directory = mkdtempSync(path.join(tmpdir(), 'orca-qrcode-import-lint-'))
|
|
const sourcePath = path.join(directory, 'sample.ts')
|
|
const configPath = path.join(directory, 'oxlint.json')
|
|
writeFileSync(sourcePath, source)
|
|
writeFileSync(
|
|
configPath,
|
|
JSON.stringify({
|
|
categories: { correctness: 'off' },
|
|
jsPlugins: [{ name: 'mobile-pairing', specifier: pluginPath }],
|
|
rules: { 'mobile-pairing/no-eager-qrcode-import': 'error' }
|
|
})
|
|
)
|
|
const result = spawnSync(
|
|
oxlint.command,
|
|
[...oxlint.prefixArgs, '--config', configPath, '--format', 'json', sourcePath],
|
|
{ encoding: 'utf8', windowsHide: true }
|
|
)
|
|
if (result.error) {
|
|
throw result.error
|
|
}
|
|
return JSON.parse(result.stdout).diagnostics
|
|
}
|
|
|
|
describe('mobile pairing qrcode import rule', () => {
|
|
it('rejects eager runtime imports', () => {
|
|
const diagnostics = lintSource("import QRCode from 'qrcode'\nvoid QRCode")
|
|
|
|
expect(diagnostics.map((diagnostic) => diagnostic.code)).toEqual([
|
|
'mobile-pairing(no-eager-qrcode-import)'
|
|
])
|
|
})
|
|
|
|
it('allows type-only and lazy imports', () => {
|
|
expect(lintSource("import type QRCode from 'qrcode'\nlet qr: typeof QRCode")).toEqual([])
|
|
expect(lintSource("const QRCode = await import('qrcode')\nvoid QRCode")).toEqual([])
|
|
})
|
|
})
|