fix(miner): flatten calibration module to match the flat lib/ convention#3772
Merged
Conversation
packages/gittensory-miner/lib/calibration/{index,types}.{js,d.ts} was the
only nested directory under lib/ — every other module is a flat
lib/<name>.(js|d.ts) file. scripts/check-miner-package.mjs's pack-safety
allowlist only accepts that flat one-segment shape, so the real npm pack
--dry-run of this package started failing test:miner-pack (a required CI
check) as soon as the nested files landed, breaking validate-code/validate
for every PR against main.
Flatten to lib/calibration.js + lib/calibration-types.js (mirroring the
existing <name>.js / <name>-cli.js / <name>-expiry.js pairing convention
elsewhere in lib/) instead of widening the pack-safety allowlist.
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
gittensory-ui | 96836f5 | Commit Preview URL Branch Preview URL |
Jul 06 2026, 08:34 AM |
14 tasks
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3772 +/- ##
=======================================
Coverage ? 93.29%
=======================================
Files ? 317
Lines ? 32368
Branches ? 11872
=======================================
Hits ? 30199
Misses ? 1537
Partials ? 632 🚀 New features to boost your workflow:
|
16 tasks
JSONbored
added a commit
that referenced
this pull request
Jul 6, 2026
#3778 widened scripts/check-miner-package.mjs's ALLOWED regex to accept one level of subdirectory under lib/, to accommodate the calibration module's nested lib/calibration/{index,types}.{js,d.ts} layout from #3704. #3772 (merged minutes earlier, independently fixing the same main-red CI break) took the opposite approach: it flattened that module to lib/calibration.js + lib/calibration-types.js instead, matching every other module in the package. With the nested directory gone, #3778's widening is dead weight -- it permanently weakens a security-relevant pack-safety allowlist (the only guard against an arbitrary nested file sneaking into the published npm package) for zero remaining benefit. Restore the strict flat-only pattern and turn the now-obsolete "accepts a subdirectory" test into a rejection test, so a future nested lib/ file is caught here instead of requiring another regex widening.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
packages/gittensory-miner/lib/calibration/{index,types}.{js,d.ts}(added by chore(miner): scaffold calibration module types (#2332) #3704) was the only nested directory underlib/— every other module ships as a flatlib/<name>.(js|d.ts)file.scripts/check-miner-package.mjs's pack-safety allowlist only accepts that flat one-segment shape, so the realnpm pack --dry-runof this package has been failingtest:miner-packsince chore(miner): scaffold calibration module types (#2332) #3704 merged — a required check, sovalidate-code/validateis currently red onmainfor every PR.lib/calibration.js+lib/calibration-types.js, mirroring the existing<name>.js/<name>-cli.js/<name>-expiry.jspairing convention already used throughoutlib/, rather than widening the pack-safety allowlist to accept nested paths.No issue filed — this is a direct, currently-broken-main fix; small enough that this summary explains why.
Scope
type(scope): short summaryConventional Commit format.CONTRIBUTING.mdand does not touchsite/,CNAME, or GitHub Pages.Validation
git diff --checknpm run actionlintnpm run typechecknpm run test:coverage— not run in full;packages/**andtest/**are excluded fromcodecov/patch(onlysrc/**is measured), and the two directly affected test files were run directly (see below)npm run test:workers— unaffected by this change (no Worker/D1 code touched)npm run build:miner(wasbuild:mcpin the template — this PR touches the miner package, not MCP)npm run test:miner-pack— the exact check this PR fixes; now passes on the real workspace packagenpm run ui:openapi:check/ui:lint/ui:typecheck/ui:build— unaffected, no UI/API surface touchednpm audit --audit-level=moderatenpx vitest run test/unit/check-miner-package.test.ts test/unit/miner-calibration-types.test.ts— 9/9 passedIf any required check was skipped, explain why:
packages/gittensory-miner/lib/and updates two import paths — no UI, API, OpenAPI, Wrangler, or MCP surface is touched.Safety
Notes
mainis currently red: the last two completedmainCI runs (after feat(observability): expand self-host Sentry context and monitors #3752 and test(miner-discovery): end-to-end Phase 1 pipeline fixture (#2311) #3756 merged) both failtest/unit/check-miner-package.test.ts > passes on the real miner workspace packagewithUnexpected file in miner package: lib/calibration/index.d.ts.