Repository navigation
Upgrade dev toolchain to clear Dependabot alerts; move CI to GitHub Actions on Node 24 - #23
Merged
Merged
Conversation
All open Dependabot alerts come from 2020-era dev tooling in yarn.lock; prolly has no runtime dependencies. - eslint 6 -> 10, migrating .eslintrc/.eslintignore/test/.eslintrc to a flat eslint.config.js with equivalent rules (ES2015 syntax, node globals, mocha globals and should-ignore for tests) - mocha 7 -> 12 - nyc -> c8 (native V8 coverage), dropping the Babel/istanbul tree - remove eslint-plugin-import and eslint-plugin-mocha (no rules used) - regenerate yarn.lock from scratch (316 -> 134 packages) - update .npmignore for the new config files Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Travis hasn't reported a status on master in years and still targeted Node 8/10/12. Add a Build workflow modelled on ombud-lib-template that reads Node from .nvmrc (24), runs on arc-runner-build with SHA-pinned actions, and runs `yarn ci-test` (c8 coverage + mocha + eslint). Swap the README's Travis and Codecov badges for the Actions badge; coverage is no longer uploaded to Codecov. npm publishing (previously a Travis deploy stage) will follow in a separate PR. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The push trigger targeted `main`, but this repo's default branch is `master`, so it never fired. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The misspelled `engine` string key was ignored by npm/yarn; use the standard `engines` object form with the same constraint. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
prolly is a public repo. GitHub doesn't allow public repos to use actions or reusable workflows from private repos, so action-lint, dependabot-alert-handler and pr-summarizer (all backed by the private gha-shared repo) fail with a workflow file error. The org's ARC runners also don't pick up jobs from public repos, leaving Build queued. Move Build to ubuntu-latest, which is also the safer choice for a public repo since fork PRs can't reach internal runners, and remove the three gha-shared workflows. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The regenerated lockfile picked up the CodeArtifact registry from a user-level ~/.npmrc, so CI failed with 401s fetching tarballs. Add a project .npmrc pinning the public registry so installs and future lockfile updates don't depend on local config, and re-resolve the lockfile (same versions, only `resolved` URLs change). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Tee the ci-test output and render it into $GITHUB_STEP_SUMMARY: mocha pass/fail counts, the c8 coverage table, and the full log in a collapsed section. Runs on failure too, and `shell: bash` adds pipefail so the tee doesn't mask a failing test run. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Node timers can fire up to ~1ms early when measured with Date.now(), so the parallel() lower-bound duration checks failed intermittently (e.g. "expected 24 to be above or equal 25" on CI). Apply the same `- 1` slack the wait() tests already use. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clears all 34 open Dependabot alerts and moves CI to GitHub Actions on Node 24.
Every alert came from 2020-era dev tooling in
yarn.lock.prollyhas no runtime dependencies, so nothing changes for consumers: the published tarball is still justLICENSE,README.md,index.jsandpackage.json.Dev toolchain
.eslintrc,.eslintignoreandtest/.eslintrcbecome oneeslint.config.jswith the same rules: ES2015 syntax, node globals, mocha globals for tests, and theshouldunused-var exception.eslint-plugin-importandeslint-plugin-mocha. Neither contributed any rules.yarn.lockfrom scratch: 316 → 134 packages. 13 of the flagged packages are gone entirely; the rest resolve to patched versions.npm auditreports 0 vulnerabilities..npmrcthat pins the public npm registry, so a CodeArtifact registry in someone's~/.npmrccan't leak intoyarn.lockagain.CI
.travis.ymlwith.github/workflows/build.yml. Travis hasn't reported a status onmasterin years and still targeted Node 8/10/12. The new workflow gets Node from.nvmrc(24) and runsyarn ci-test(c8 coverage, mocha, eslint).ubuntu-latest, not the org's ARC runners.prollyis public, and the ARC runners don't pick up public-repo jobs. GitHub-hosted runners also keep fork PRs off internal infrastructure.gha-sharedworkflows (action-lint, dependabot-alert-handler, pr-summarizer). GitHub doesn't allow public repos to use actions or reusable workflows from private repos, so they failed with a workflow file error.Other
Fixed the misspelled
enginekey inpackage.json, which npm and yarn were ignoring. It's nowengines: { node: ">=4.0.0" }, the same constraint.Fixed flaky
.parallelduration assertions. Node timers can fire up to about 1 ms early when measured withDate.now(), which made the lower-bound checks fail intermittently (1 in 40 runs locally, and once on this PR). They now use the same- 1slack as the.waittests.Not in this PR
Test plan
yarn ci-testpasses locally on Node 24.21: 32 tests, 100% line coverage, eslint cleanyarn install --frozen-lockfilesucceeds with a fresh cache and no user-level npm/yarn configThe Dependabot alerts close once this merges and Dependabot rescans
master.🤖 Generated with Claude Code