chore(miner): add test:miner-pack publish-shape checker

[kiannidev]

Closes #2310

Summary

• Add scripts/check-miner-package.mjs, mirroring check-mcp-package.mjs for @jsonbored/gittensory-miner (npm pack dry-run, allowlist, secret scan).
• Wire test:miner-pack in root package.json and enforce it on the main validation path via test:ci (... build:miner && test:miner-pack ...).
• Vitest exercises the checker via subprocess only (no .mjs type imports) plus env-injected failure fixtures.

Conflict avoidance

Touches only scripts/check-miner-package.mjs (new), test/unit/check-miner-package.test.ts (new), and package.json (test:miner-pack + test:ci segment). No overlap with open PRs #3513, #3520, #3521.

Test plan

• npm run test:miner-pack
• COVERAGE_NO_THRESHOLDS=1 npx vitest run test/unit/check-miner-package.test.ts --coverage
• npm run build --workspace @jsonbored/gittensory-engine && npm run build:miner

Made with Cursor

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 Gittensory review result - reject/close recommended

_{Review updated: 2026-07-05 15:36:11 UTC}

3 files · 1 AI reviewer · 2 blockers · readiness 80/100 · CI green · clean

🛑 Suggested Action - Reject/Close

• AI reviewers agree on a likely critical defect: scripts/check-miner-package.mjs:33 validates only the files returned by `npm pack`, so a package that accidentally omits `bin/gittensory-miner.js` or all `lib/*` artifacts still returns `Miner package dry-run ok`
• add required-file assertions after `validateMinerPackFileList`, for example `if (!paths.includes("bin/gittensory-miner.js")) throw new Error("Miner package is missing bin/gittensory-miner.js")
• ` and require at least one built `lib/*.js` plus its declaration file, or tell me why an allowlist-only gate is enough for docs(miner-discovery): package.json test:mcp-pack + build:mcp parity checks for gittensory-miner #2310. — Resolve the flagged defect, or override if the AI reviewers are mistaken, then re-run the gate.
• Possible leaked secret in the diff (github_pat) — Remove the secret from the diff, rotate the exposed credential, then re-run the gate.

Review summary
The PR adds a miner package dry-run checker, wires it into `test:ci`, and covers the rejection paths through subprocess tests. The allowlist and secret scan are useful, but the checker only validates files that are present, so it can still report success for an incomplete miner package that omits the executable or built output. That makes the new gate fail-open for a key publish-shape regression.

Blockers

• scripts/check-miner-package.mjs:33 validates only the files returned by `npm pack`, so a package that accidentally omits `bin/gittensory-miner.js` or all `lib/*` artifacts still returns `Miner package dry-run ok`; add required-file assertions after `validateMinerPackFileList`, for example `if (!paths.includes("bin/gittensory-miner.js")) throw new Error("Miner package is missing bin/gittensory-miner.js");` and require at least one built `lib/*.js` plus its declaration file, or tell me why an allowlist-only gate is enough for docs(miner-discovery): package.json test:mcp-pack + build:mcp parity checks for gittensory-miner #2310.

Nits — 5 non-blocking

• nit: scripts/check-miner-package.mjs:28 lets `CHECK_MINER_PACK_TEST_CONTENT` override real file reads even when the checker is running against the real npm pack output, so keep that fixture hook tied to `CHECK_MINER_PACK_TEST_FILES` or prefer the exported function path for content-injection tests.
• nit: test/unit/check-miner-package.test.ts:17 checks the current real package contains the bin path, but there is no fixture proving the checker fails when a required miner entrypoint is absent.
• scripts/check-miner-package.mjs:33 should turn the publish-shape contract into explicit required-file checks, not just an allowlist of whatever npm reports.
• test/unit/check-miner-package.test.ts:17 should add a negative fixture such as `CHECK_MINER_PACK_TEST_FILES: JSON.stringify(["package.json", "README.md"])` and assert it fails for the missing miner bin/build artifacts.
• scripts/check-miner-package.mjs:28 should remove or narrow the global content override so a stray environment variable cannot make the real checker scan synthetic content instead of package contents.

Why this is blocked

• scripts/check-miner-package.mjs:33 validates only the files returned by `npm pack`, so a package that accidentally omits `bin/gittensory-miner.js` or all `lib/*` artifacts still returns `Miner package dry-run ok`; add required-file assertions after `validateMinerPackFileList`, for example `if (!paths.includes("bin/gittensory-miner.js")) throw new Error("Miner package is missing bin/gittensory-miner.js");` and require at least one built `lib/*.js` plus its declaration file, or tell me why an allowlist-only gate is enough for docs(miner-discovery): package.json test:mcp-pack + build:mcp parity checks for gittensory-miner #2310.
• Possible leaked secret in the diff (github_pat) — Remove the secret from the diff, rotate the exposed credential, then re-run the gate.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	✅ Linked	#2310
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 1433 registered-repo PR(s), 732 merged, 48 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	kiannidev; Gittensor profile; 1433 PR(s), 48 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: kiannidev
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 1433 PR(s), 48 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Await review-lane availability.
• Refresh registry data or choose a registered active repo.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.09%. Comparing base (fc021a5) to head (7f1c875).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3522   +/-   ##
=======================================
  Coverage   93.09%   93.09%           
=======================================
  Files         301      301           
  Lines       31450    31450           
  Branches    11483    11483           
=======================================
  Hits        29279    29279           
  Misses       1517     1517           
  Partials      654      654           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Gittensory is closing this pull request on the maintainer's behalf (Possible leaked secret in the diff (github_pat)). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.