Skip to content

t12(T12-L07): Pin how the package version is resolved - #685

Merged
DealAppSeo merged 1 commit into
mainfrom
t12/T12-L07-e2
Nov 8, 2026
Merged

DealAppSeo merged 1 commit into
mainfrom
t12/T12-L07-e2

Conversation

@DealAppSeo

Copy link
Copy Markdown
Owner

T12 lane deliverable for T12-L07. Checked by a fresh-checkout re-run at b0461f1, with a negative control. That proves the test passes with this change and fails without it, not that the test is good. Review before merging.

@vercel

vercel Bot commented Nov 8, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
trustshell-landing Ready Ready Preview Nov 8, 2026 5:01pm UTC

Request Review

@github-actions

github-actions Bot commented Nov 8, 2026

Copy link
Copy Markdown

🧾 Receipt

1 claim(s) checked against GitHub's own check runs on b0461f1: 1 verified · 0 not checked · 0 failed

Claim Said in Evidence Result
tests: That proves the test passes with this change and fails without it, not that the test is good. PR description step `Unit tests` in check passed and the job's own workflow file at this commit runs a matching command, and every other check on this commit finished green, skipped or neutral. ✅ VERIFIED
What this receipt does not prove
  • A green check proves that check passed on this commit. It does not prove the check tested this change.
  • Evidence is read at the strongest level each check offers: the run: command of the job, taken from the workflow file at this commit; else the step name and that step own result; else the check name alone. The Result column says which. A check name is a label, not evidence.
  • At command level the receipt confirms the job runs a command that normally runs this kind of check. It cannot confirm the command asserted anything: a test script that exits 0 without running a test still reads as tests.
  • A job whose steps cannot be read (a third-party check, or no actions: read permission) is matched by its name alone, and a job whose work happens inside a composite action shows no command.
  • Claims are read from the PR description and the latest commit message by plain patterns. A claim worded unusually is not seen. Text in double quotes, code blocks and block quotes is ignored on purpose; text in single quotes is read, because a single quote is also an apostrophe.
  • A check created after this receipt was written is not counted until the receipt runs again.

Receipts by TrustShell. Read-only: it reads this PR and its check runs, and writes only this comment. No code leaves the repo.

@DealAppSeo
DealAppSeo marked this pull request as ready for review November 8, 2026 17:05
@strix-security

strix-security Bot commented Nov 8, 2026 •

Copy link
Copy Markdown

Strix Security Review

✅ No open security findings.

PR summary: Adds a Jest test file that pins how `resolvePackageVersion` resolves the package version from package.json, including the `"unknown"` fallbacks for empty, non-string, and missing versions.

Review summary

This PR adds a single Jest unit test, tests/version-resolve.test.ts, pinning the contract of the existing resolvePackageVersion helper in src/lib/version.ts (returns the package.json version string, or "unknown" for empty, non-string, or missing versions). No production code, configuration, dependency, or build/CI behavior is changed, and the test only exercises a pure read-and-parse helper against a temporary directory. Lint triage of all 147 items found nothing in the changed file or its import closure (the helper imports only node:fs and node:path); the only related items are pre-existing findings in unrelated callers. No security issues found in the changed code.

Review 1 on this PR · b0461f1 · requested Nov 8 17:05 UTC when the PR was opened


Reviewed by Strix
Re-run review · Configure security review settings

@strix-security strix-security Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR adds a single Jest unit test, tests/version-resolve.test.ts, pinning the contract of the existing resolvePackageVersion helper in src/lib/version.ts (returns the package.json version string, or "unknown" for empty, non-string, or missing versions). No production code, configuration, dependency, or build/CI behavior is changed, and the test only exercises a pure read-and-parse helper against a temporary directory. Lint triage of all 147 items found nothing in the changed file or its import closure (the helper imports only node:fs and node:path); the only related items are pre-existing findings in unrelated callers. No security issues found in the changed code.


Reviewed by Strix
Configure security review settings

@DealAppSeo
DealAppSeo merged commit 0ae3a78 into main Nov 8, 2026
11 checks passed

This branch was successfully deployed

1 active deployment
Preview — b0461f1a Deployed Nov 8, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant