fix(ci): allow dist/ in the MCP pack allowlist, which is the only thing it ships - #9950
Merged
Conversation
Contributor
|
Important 🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨 ⏳ LoopOver is waiting…LoopOver has seen this pull request and is waiting on CI checks to finish before reviewing it. This comment will update once the review runs. 🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟨 Waiting |
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #9950 +/- ##
=======================================
Coverage 91.88% 91.88%
=======================================
Files 928 928
Lines 113675 113675
Branches 27412 27412
=======================================
Hits 104445 104445
Misses 7931 7931
Partials 1299 1299
Flags with carried forward coverage won't be shown. Click here to find out more. |
JSONbored
added a commit
that referenced
this pull request
Jul 30, 2026
…a checker so it stays fixed (#9958) A test fixture that calls Date.now() once PER TIMESTAMP produces timestamps that disagree with each other by however long elapsed between the calls. Where the code under test derives a boundary from one of them, a single millisecond flips the result. queue-trends.test.ts had exactly that: function atDaysAgo(daysAgo: number) { return new Date(Date.now() - ...); } buildWindow anchors on the newest snapshot: targetMs = latestMs - windowDays * day baseline = newest snapshot with fetchedAt <= targetMs `atDaysAgo(0)` evaluated at T0 and `atDaysAgo(7)` a moment later at T1 put the "7 days ago" row at T1-7d -- NEWER than the target T0-7d. No baseline, every window "unavailable", assertion fails. Reproduced deterministically with a 2ms offset. It fired for real on #9950, a PR whose only changed file was a GitHub workflow, which is how it was spotted. This matters more than a flaky test usually would: reviews are one-shot for everyone but the maintainer, so a false red on a contributor PR is not a re-run away from fine -- it auto-closes correct work the contributor cannot reopen. Every offset helper in the suite is now anchored to one instant per file (11 files). scripts/check-fixture-clock-races.ts keeps it that way, wired into test:ci. The checker only reports helpers that PROJECT a timestamp from an offset the caller varies. Reading the clock live stays correct where the passage of time is itself under test -- a polling waitFor, a lock-expiry comparison -- and those are not reported. Its own tests pin both directions, because a checker that cries wolf gets muted, and a muted checker is worse than none. Writing those tests caught two bugs in the checker itself: it undercounted arrow-form helpers by one (`const name = (` does not match the call shape the `-1` assumed), which silently exempted the exactly-two-call case -- the smallest set that can race -- and its operator-to-parameter span crossed commas, so a token-expiry helper read as a fixture race. Closes #9955
…ng it ships #9946 unblocked the MCP publish build; packing then failed on the very next step with "Unexpected file in package tarball". The allowlist permits package/(bin|lib|scripts)/, which describes a source layout this package has not had for some time. Its package.json ships `files: ["dist", "scripts", ...]` and both `bin` entries point at dist/bin/*.js -- so dist/ is not stray output, it is the entire package. Verified against a real `npm pack`: the tarball contains dist/, scripts/ and the four metadata files, and the old pattern rejected exactly the 9 dist/ entries. With the corrected pattern all three smoke-test stages pass locally -- allowlist clean, secret scan clean, and the installed binary answers --help. The mismatch stayed invisible because the build step failed first, so packing never ran. Fixing one exposed the next: this is the second half of the same never-succeeded publish.
JSONbored
force-pushed
the
fix/mcp-pack-allowlist
branch
from
July 30, 2026 21:20
6ff9523 to
adefdb6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-on to #9946/#9947. That fix unblocked the MCP publish build; packing then failed on the very next step with
Unexpected file in package tarball.The stale rule
The smoke test allows
package/(bin|lib|scripts)/…, which describes a source layout this package has not had for some time. Its manifest says:dist/is not stray build output — it is the package.Verified against a real tarball
Ran
npm pack --workspace @loopover/mcpand inspected it: contents aredist/,scripts/,package.json,README.md,CHANGELOG.md,LICENSE, and the old pattern rejected exactly the 9dist/entries. With the corrected pattern, all three smoke-test stages pass locally:npm install <tarball>thenloopover-mcp --help— passesactionlintclean.Why it hid
The build step failed first, so packing never ran. Fixing one exposed the next — this is the second half of the same publish that has never succeeded. The Miner publish, which had only the first problem, is already green on
main.