From 7cb244d3d9527aa1c054b73cd67e7b9814bf4133 Mon Sep 17 00:00:00 2001
From: Amaad Martin <amaadmartin@google.com>
Date: Fri, 31 Jul 2026 15:51:53 -0700
Subject: [PATCH 1/2] Test: fail CI when a root test script targets a vitest
 project no workflow runs

Nothing today proves the test scripts in the root package.json are actually
executed by a GitHub Actions workflow. Dropping a --project flag from
test:coverage, or adding a test:* script nobody wires into a workflow, leaves
CI green while those tests silently stop running. The integration project
hosts the repo's own meta-guards, so that failure mode hides itself.

Add a dependency-free guard that walks root test script -> vitest project ->
workflow step by reading package.json and .github/workflows/*.{yml,yaml}, and
fails naming both the orphaned project and the script that declares it.
---
 .../repo_config/workflow_scripts_test.ts      | 160 ++++++++++++++++++
 1 file changed, 160 insertions(+)
 create mode 100644 tests/integration/repo_config/workflow_scripts_test.ts

diff --git a/tests/integration/repo_config/workflow_scripts_test.ts b/tests/integration/repo_config/workflow_scripts_test.ts
new file mode 100644
index 000000000..ef4ac48b0
--- /dev/null
+++ b/tests/integration/repo_config/workflow_scripts_test.ts
@@ -0,0 +1,160 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {describe, expect, it} from 'vitest';
+import rootPackage from '../../../package.json' with {type: 'json'};
+
+const WORKFLOWS_DIR = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '../../../.github/workflows',
+);
+
+/** A GitHub Actions workflow file: `<name>.yml` or `<name>.yaml`. */
+const WORKFLOW_FILE_PATTERN = /\.ya?ml$/;
+
+/** `npm run <script>` as it appears in a workflow `run:` step. */
+const NPM_RUN_PATTERN = /\bnpm\s+run\s+([\w:@./-]+)/g;
+
+/** `--project <name>` or `--project=<name>` in an npm script command. */
+const PROJECT_FLAG_PATTERN = /--project[=\s]+([^\s"']+)/g;
+
+/** Root scripts that run tests: `test`, `test:unit`, `test:coverage`, ... */
+const TEST_SCRIPT_PATTERN = /^test(:|$)/;
+
+/** Raw text of every workflow file. Throws if the directory is missing. */
+async function readWorkflowFiles(): Promise<string[]> {
+  const entries = await fs.readdir(WORKFLOWS_DIR);
+  return Promise.all(
+    entries
+      .filter((entry) => WORKFLOW_FILE_PATTERN.test(entry))
+      .map((entry) => fs.readFile(path.join(WORKFLOWS_DIR, entry), 'utf-8')),
+  );
+}
+
+/** Drops whole-line `#` comments so a commented-out step reads as absent. */
+function stripCommentLines(text: string): string {
+  return text
+    .split('\n')
+    .filter((line) => !line.trimStart().startsWith('#'))
+    .join('\n');
+}
+
+function extractNpmRunScripts(text: string): string[] {
+  return [...stripCommentLines(text).matchAll(NPM_RUN_PATTERN)].map(
+    (match) => match[1],
+  );
+}
+
+function extractProjects(command: string): string[] {
+  return [...command.matchAll(PROJECT_FLAG_PATTERN)].map((match) => match[1]);
+}
+
+/**
+ * One message per vitest project that a root test script targets but that no
+ * workflow-invoked script runs, naming both the project and the script.
+ */
+function findUnwiredProjects(
+  scripts: Record<string, string>,
+  workflowProjects: Set<string>,
+): string[] {
+  return Object.entries(scripts)
+    .filter(([name]) => TEST_SCRIPT_PATTERN.test(name))
+    .flatMap(([name, command]) =>
+      extractProjects(command)
+        .filter((project) => !workflowProjects.has(project))
+        .map(
+          (project) =>
+            `vitest project "${project}" (from "npm run ${name}") is not ` +
+            `run by any .github/workflows step`,
+        ),
+    );
+}
+
+describe('GitHub workflow / npm script wiring', () => {
+  it('every npm run invocation in .github/workflows names a root script', async () => {
+    const workflowFiles = await readWorkflowFiles();
+    const invokedScripts = workflowFiles.flatMap(extractNpmRunScripts);
+
+    expect(workflowFiles.length).toBeGreaterThan(0);
+    expect(invokedScripts.length).toBeGreaterThan(0);
+    expect(
+      invokedScripts.filter(
+        (name) => !Object.hasOwn(rootPackage.scripts, name),
+      ),
+      'These .github/workflows steps run npm scripts that the root ' +
+        'package.json does not define, so the step cannot do what it says.',
+    ).toEqual([]);
+  });
+
+  it('every vitest project a root test script targets is run by a workflow', async () => {
+    const invokedScripts = new Set(
+      (await readWorkflowFiles()).flatMap(extractNpmRunScripts),
+    );
+    const workflowProjects = new Set(
+      Object.entries(rootPackage.scripts)
+        .filter(([name]) => invokedScripts.has(name))
+        .flatMap(([, command]) => extractProjects(command)),
+    );
+
+    expect(workflowProjects.size).toBeGreaterThan(0);
+    expect(
+      findUnwiredProjects(rootPackage.scripts, workflowProjects),
+      'A root test script targets a vitest project that no ' +
+        '.github/workflows step runs, so those tests never execute in CI.',
+    ).toEqual([]);
+  });
+});
+
+describe('workflow script parsing', () => {
+  it('ignores npm run invocations on commented-out lines', () => {
+    expect(
+      extractNpmRunScripts('      - name: Test\n        run: npm run test:x'),
+    ).toEqual(['test:x']);
+    expect(
+      extractNpmRunScripts('      # - name: Test\n      #   run: npm run x'),
+    ).toEqual([]);
+  });
+
+  it('reads both the --project name and --project=name spellings', () => {
+    expect(
+      extractProjects(
+        'vitest run --project unit:core --project=e2e --coverage',
+      ),
+    ).toEqual(['unit:core', 'e2e']);
+    expect(extractProjects('tsc --noEmit')).toEqual([]);
+  });
+
+  it('rescans from the start of the input on a repeated call', () => {
+    const command = 'vitest --project integration';
+    expect(extractProjects(command)).toEqual(['integration']);
+    expect(extractProjects(command)).toEqual(['integration']);
+
+    const step = 'run: npm run build && npm run lint';
+    expect(extractNpmRunScripts(step)).toEqual(['build', 'lint']);
+    expect(extractNpmRunScripts(step)).toEqual(['build', 'lint']);
+  });
+
+  it('names every unwired project and the script that targets it', () => {
+    expect(
+      findUnwiredProjects(
+        {
+          test: 'vitest --project unit:core --project e2e',
+          'test:foo': 'vitest --project foo',
+          testbed: 'vitest --project testbed',
+        },
+        new Set(['unit:core']),
+      ),
+    ).toEqual([
+      'vitest project "e2e" (from "npm run test") is not run by any ' +
+        '.github/workflows step',
+      'vitest project "foo" (from "npm run test:foo") is not run by any ' +
+        '.github/workflows step',
+    ]);
+  });
+});

From 9c184ebf3be169597b81803df1051bfc8e9b1f9f Mon Sep 17 00:00:00 2001
From: Amaad Martin <amaadmartin@google.com>
Date: Fri, 31 Jul 2026 16:21:46 -0700
Subject: [PATCH 2/2] Test: scope the wiring guard by vitest invocation, not by
 script name

The guard filtered candidate scripts with a /^test(:|$)/ name pattern, which
proxies the condition it actually cares about: whether the command runs vitest.
Replace it with a direct check on the command itself, applied inside the
project extractor so both sides of the comparison use one rule.

This also closes a false positive the name filter was silently covering:
--project is not vitest-specific. `tsc --project tsconfig.json` is the same
flag, and ts:check is actively moving toward a -p form, so a script picking up
the long spelling would have been reported as an unwired vitest project.

Behaviour on the current tree is unchanged: every root script carrying
--project today runs vitest. Dropping the name filter also widens the guard to
a vitest script that is not named test*, which the old pattern ignored.
---
 .../repo_config/workflow_scripts_test.ts      | 57 +++++++++++--------
 1 file changed, 32 insertions(+), 25 deletions(-)

diff --git a/tests/integration/repo_config/workflow_scripts_test.ts b/tests/integration/repo_config/workflow_scripts_test.ts
index ef4ac48b0..cef178f05 100644
--- a/tests/integration/repo_config/workflow_scripts_test.ts
+++ b/tests/integration/repo_config/workflow_scripts_test.ts
@@ -24,8 +24,8 @@ const NPM_RUN_PATTERN = /\bnpm\s+run\s+([\w:@./-]+)/g;
 /** `--project <name>` or `--project=<name>` in an npm script command. */
 const PROJECT_FLAG_PATTERN = /--project[=\s]+([^\s"']+)/g;
 
-/** Root scripts that run tests: `test`, `test:unit`, `test:coverage`, ... */
-const TEST_SCRIPT_PATTERN = /^test(:|$)/;
+/** A command that runs vitest, rather than another tool taking `--project`. */
+const VITEST_COMMAND_PATTERN = /\bvitest\b/;
 
 /** Raw text of every workflow file. Throws if the directory is missing. */
 async function readWorkflowFiles(): Promise<string[]> {
@@ -51,29 +51,34 @@ function extractNpmRunScripts(text: string): string[] {
   );
 }
 
-function extractProjects(command: string): string[] {
-  return [...command.matchAll(PROJECT_FLAG_PATTERN)].map((match) => match[1]);
+/**
+ * Vitest projects a command selects. Other tools take a `--project` flag too
+ * (`tsc --project tsconfig.json`), so a command that does not run vitest
+ * selects none.
+ */
+function vitestProjects(command: string): string[] {
+  return VITEST_COMMAND_PATTERN.test(command)
+    ? [...command.matchAll(PROJECT_FLAG_PATTERN)].map((match) => match[1])
+    : [];
 }
 
 /**
- * One message per vitest project that a root test script targets but that no
+ * One message per vitest project that a root script runs but that no
  * workflow-invoked script runs, naming both the project and the script.
  */
 function findUnwiredProjects(
   scripts: Record<string, string>,
   workflowProjects: Set<string>,
 ): string[] {
-  return Object.entries(scripts)
-    .filter(([name]) => TEST_SCRIPT_PATTERN.test(name))
-    .flatMap(([name, command]) =>
-      extractProjects(command)
-        .filter((project) => !workflowProjects.has(project))
-        .map(
-          (project) =>
-            `vitest project "${project}" (from "npm run ${name}") is not ` +
-            `run by any .github/workflows step`,
-        ),
-    );
+  return Object.entries(scripts).flatMap(([name, command]) =>
+    vitestProjects(command)
+      .filter((project) => !workflowProjects.has(project))
+      .map(
+        (project) =>
+          `vitest project "${project}" (from "npm run ${name}") is not ` +
+          `run by any .github/workflows step`,
+      ),
+  );
 }
 
 describe('GitHub workflow / npm script wiring', () => {
@@ -99,7 +104,7 @@ describe('GitHub workflow / npm script wiring', () => {
     const workflowProjects = new Set(
       Object.entries(rootPackage.scripts)
         .filter(([name]) => invokedScripts.has(name))
-        .flatMap(([, command]) => extractProjects(command)),
+        .flatMap(([, command]) => vitestProjects(command)),
     );
 
     expect(workflowProjects.size).toBeGreaterThan(0);
@@ -123,30 +128,32 @@ describe('workflow script parsing', () => {
 
   it('reads both the --project name and --project=name spellings', () => {
     expect(
-      extractProjects(
-        'vitest run --project unit:core --project=e2e --coverage',
-      ),
+      vitestProjects('vitest run --project unit:core --project=e2e --coverage'),
     ).toEqual(['unit:core', 'e2e']);
-    expect(extractProjects('tsc --noEmit')).toEqual([]);
+    expect(vitestProjects('vitest run --coverage')).toEqual([]);
+  });
+
+  it('claims no project for a non-vitest tool that also takes --project', () => {
+    expect(vitestProjects('tsc --project tsconfig.check.json')).toEqual([]);
   });
 
   it('rescans from the start of the input on a repeated call', () => {
     const command = 'vitest --project integration';
-    expect(extractProjects(command)).toEqual(['integration']);
-    expect(extractProjects(command)).toEqual(['integration']);
+    expect(vitestProjects(command)).toEqual(['integration']);
+    expect(vitestProjects(command)).toEqual(['integration']);
 
     const step = 'run: npm run build && npm run lint';
     expect(extractNpmRunScripts(step)).toEqual(['build', 'lint']);
     expect(extractNpmRunScripts(step)).toEqual(['build', 'lint']);
   });
 
-  it('names every unwired project and the script that targets it', () => {
+  it('names every unwired project and the script that runs it', () => {
     expect(
       findUnwiredProjects(
         {
           test: 'vitest --project unit:core --project e2e',
           'test:foo': 'vitest --project foo',
-          testbed: 'vitest --project testbed',
+          'ts:check': 'tsc --project tsconfig.check.json',
         },
         new Set(['unit:core']),
       ),