mirror of
https://github.com/stablyai/orca.git
synced 2026-09-21 16:02:20 +00:00
OrcaWinandOrca Worker
3ae51076b1
* fix(tooling): run oxlint gates without a Windows .cmd shim
`check:code-quality:changed` spawned `pnpm.cmd` without a shell, which Node
refuses under the CVE-2024-27980 mitigation, so the gate died with EINVAL
before linting anything. Resolve oxlint's own Node bin and run it under this
process's node instead — no shim, no shell, no quoting question — and add a
ratchet so the idiom cannot spread back into config/scripts.
* fix(tooling): validate the react-doctor diff base and widen the shim ratchet
`base` reaches cmd.exe unquoted on the shell fallback, so reject anything
outside a git revision before spawning. The ratchet matched only a handful of
runner names, which let `vitest.cmd` through even though config/scripts already
spawns vitest, playwright and electron-builder; match any batch-shim literal
instead, walk subdirectories, and cover tests/tools.
* docs(tooling): state what the shim ratchet and diff-base check miss
Both comments read as complete accounts of their guard's coverage. The revision
class rejects reflog syntax like HEAD@{1}, deliberately, since braces have no
business in a cmd.exe-bound argument; the ratchet misses a drive-lettered
literal because a colon is not in its class. Say so beside the template-literal
ceiling already noted.
---------
Co-authored-by: Orca Worker <orca-worker@localhost>
34 lines
1.2 KiB
JavaScript
34 lines
1.2 KiB
JavaScript
import { spawnSync } from 'node:child_process'
|
|
import { existsSync } from 'node:fs'
|
|
import path from 'node:path'
|
|
import process from 'node:process'
|
|
import { describe, expect, it } from 'vitest'
|
|
import { resolveOxlintInvocation } from './oxlint-cli-invocation.mjs'
|
|
|
|
const repoRoot = path.resolve(import.meta.dirname, '..', '..')
|
|
|
|
describe('resolveOxlintInvocation', () => {
|
|
it('runs oxlint under this process node, never through a shim', () => {
|
|
const { command, prefixArgs } = resolveOxlintInvocation(repoRoot)
|
|
|
|
expect(command).toBe(process.execPath)
|
|
expect(prefixArgs).toHaveLength(1)
|
|
// The EINVAL that killed the changed-code gate came from spawning a .cmd.
|
|
expect(prefixArgs[0]).not.toMatch(/\.(cmd|bat)$/i)
|
|
expect(existsSync(prefixArgs[0])).toBe(true)
|
|
})
|
|
|
|
it('spawns without a shell and produces Oxlint JSON', () => {
|
|
const { command, prefixArgs } = resolveOxlintInvocation(repoRoot)
|
|
const result = spawnSync(
|
|
command,
|
|
[...prefixArgs, '--help'],
|
|
// shell:false is the point: the shim form throws EINVAL here on Windows.
|
|
{ cwd: repoRoot, encoding: 'utf8', shell: false, windowsHide: true }
|
|
)
|
|
|
|
expect(result.error).toBeUndefined()
|
|
expect(result.stdout).toContain('oxlint')
|
|
})
|
|
})
|