From 38c18c8c9b84e6f6bfe93d849364632f25b608d0 Mon Sep 17 00:00:00 2001 From: Ayoub-Mabrouk Date: Mon, 10 Nov 2025 23:26:33 +0100 Subject: [PATCH 1/2] test: add test for normalizeType fallback when mime lookup fails Add test to verify that utils.normalizeType correctly defaults to 'application/octet-stream' when mime.lookup() returns null/undefined for unknown file extensions. This covers the fallback behavior on line 64 of lib/utils.js and ensures proper handling of unrecognized MIME types. --- test/utils.js | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/test/utils.js b/test/utils.js index 1c06036a..0cfb7106 100644 --- a/test/utils.js +++ b/test/utils.js @@ -35,8 +35,15 @@ describe('utils.normalizeType acceptParams method', () => { params: {} // No parameters are added since "invalid" has no "=" }); }); -}); + it('should default to application/octet-stream when mime lookup fails', () => { + const result = utils.normalizeType('unknown-extension-xyz'); + assert.deepEqual(result, { + value: 'application/octet-stream', + params: {} + }); + }); +}); describe('utils.setCharset(type, charset)', function () { it('should do anything without type', function () { From d8522590ca3a7e239933c56f06e3996f663929f6 Mon Sep 17 00:00:00 2001 From: merget-harness bench Date: Fri, 18 Sep 2026 14:46:21 +0000 Subject: [PATCH 2/2] harness: replace CI with the benchmark recipe (npm test) --- .github/dependabot.yml | 17 ----- .github/workflows/bench-ci.yml | 26 +++++++ .github/workflows/ci.yml | 117 -------------------------------- .github/workflows/codeql.yml | 74 -------------------- .github/workflows/legacy.yml | 101 --------------------------- .github/workflows/scorecard.yml | 72 -------------------- 6 files changed, 26 insertions(+), 381 deletions(-) delete mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/bench-ci.yml delete mode 100644 .github/workflows/ci.yml delete mode 100644 .github/workflows/codeql.yml delete mode 100644 .github/workflows/legacy.yml delete mode 100644 .github/workflows/scorecard.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index a6096a49..00000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,17 +0,0 @@ -version: 2 -updates: - - package-ecosystem: github-actions - directory: / - schedule: - interval: monthly - - - package-ecosystem: npm - directory: / - schedule: - interval: monthly - time: "23:00" - timezone: Europe/London - open-pull-requests-limit: 10 - ignore: - - dependency-name: "*" - update-types: ["version-update:semver-major"] \ No newline at end of file diff --git a/.github/workflows/bench-ci.yml b/.github/workflows/bench-ci.yml new file mode 100644 index 00000000..c36ab2af --- /dev/null +++ b/.github/workflows/bench-ci.yml @@ -0,0 +1,26 @@ +# merget-harness live benchmark CI: the recipe the benchmark VM discovered for +# this corpus, run on every pull request, on main and on sema's batch branches. +# The corpus's own workflows are removed on the mirror (docs/SCENARIOS.md "bench"). +name: bench-ci +on: + push: + branches: + - "main" + - "sema/queue/**" + - "replay/**" + pull_request: {} +jobs: + test: + runs-on: ubuntu-latest + timeout-minutes: 90 + steps: + - name: "bench:checkout" + uses: actions/checkout@v4 + - name: "bench:toolchain" + uses: actions/setup-node@v4 + with: + node-version: "22" + - name: "bench:setup" + run: if [ -f package-lock.json ] || [ -f npm-shrinkwrap.json ]; then npm ci; else npm install --no-audit --no-fund; fi + - name: "bench:test" + run: npm test diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml deleted file mode 100644 index dab78159..00000000 --- a/.github/workflows/ci.yml +++ /dev/null @@ -1,117 +0,0 @@ -name: ci - -on: - push: - branches: - - master - - develop - - '4.x' - - '5.x' - - '5.0' - paths-ignore: - - '*.md' - pull_request: - workflow_dispatch: - -permissions: - contents: read - -# Cancel in progress workflows -# in the scenario where we already had a run going for that PR/branch/tag but then triggered a new run -concurrency: - group: "${{ github.workflow }} ✨ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}" - cancel-in-progress: true - -jobs: - lint: - name: Lint - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - with: - persist-credentials: false - - name: Setup Node.js - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0 - with: - node-version: 'lts/*' - - - name: Install dependencies - run: npm install --ignore-scripts --include=dev - - - name: Run lint - run: npm run lint - - test: - strategy: - fail-fast: false - matrix: - os: [ubuntu-latest, windows-latest] - node-version: [18, 19, 20, 21, 22, 23, 24, 25] - # Node.js release schedule: https://nodejs.org/en/about/releases/ - - name: Node.js ${{ matrix.node-version }} - ${{matrix.os}} - - runs-on: ${{ matrix.os }} - steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - with: - persist-credentials: false - - - name: Setup Node.js ${{ matrix.node-version }} - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0 - with: - node-version: ${{ matrix.node-version }} - - - name: Configure npm loglevel - run: | - npm config set loglevel error - shell: bash - - - name: Install dependencies - run: npm install - - - name: Output Node and NPM versions - run: | - echo "Node.js version: $(node -v)" - echo "NPM version: $(npm -v)" - - - name: Run tests - shell: bash - run: npm run test-ci - - - name: Upload code coverage - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0 - with: - name: coverage-node-${{ matrix.node-version }}-${{ matrix.os }} - path: ./coverage/lcov.info - retention-days: 1 - - coverage: - needs: test - runs-on: ubuntu-latest - permissions: - contents: read - checks: write - steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - with: - persist-credentials: false - - - name: Install lcov - shell: bash - run: sudo apt-get -y install lcov - - - name: Collect coverage reports - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 - with: - path: ./coverage - pattern: coverage-node-* - - - name: Merge coverage reports - shell: bash - run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./lcov.info - - - name: Upload coverage report - uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6 - with: - file: ./lcov.info diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 1ac121c0..00000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,74 +0,0 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# -name: "CodeQL" - -on: - push: - branches: ["master"] - pull_request: - # The branches below must be a subset of the branches above - branches: ["master"] - schedule: - - cron: "0 0 * * 1" - workflow_dispatch: - -permissions: - contents: read - -jobs: - analyze: - name: Analyze - runs-on: ubuntu-latest - permissions: - actions: read - contents: read - security-events: write - strategy: - fail-fast: false - matrix: - language: [javascript, actions] - - steps: - - name: Checkout repository - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - with: - persist-credentials: false - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v3.29.5 - with: - languages: ${{ matrix.language }} - config: | - paths-ignore: - - test - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - - # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). - # If this step fails, then you should remove it and run the build manually (see below) - # - name: Autobuild - # uses: github/codeql-action/autobuild@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7 - - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - - # If the Autobuild fails above, remove it and uncomment the following three lines. - # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. - - # - run: | - # echo "Run, Build Application using script" - # ./location_of_script_within_repo/buildscript.sh - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v3.29.5 diff --git a/.github/workflows/legacy.yml b/.github/workflows/legacy.yml deleted file mode 100644 index 1df70694..00000000 --- a/.github/workflows/legacy.yml +++ /dev/null @@ -1,101 +0,0 @@ -name: legacy - -on: - push: - branches: - - master - - develop - - '4.x' - - '5.x' - - '5.0' - paths-ignore: - - '*.md' - pull_request: - paths-ignore: - - '*.md' - workflow_dispatch: - -permissions: - contents: read - -# Cancel in progress workflows -# in the scenario where we already had a run going for that PR/branch/tag but then triggered a new run -concurrency: - group: "${{ github.workflow }} ✨ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}" - cancel-in-progress: true - -jobs: - test: - strategy: - fail-fast: false - matrix: - os: [ubuntu-latest, windows-latest] - node-version: [16, 17] - # Node.js release schedule: https://nodejs.org/en/about/releases/ - - name: Node.js ${{ matrix.node-version }} - ${{matrix.os}} - - runs-on: ${{ matrix.os }} - steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - with: - persist-credentials: false - - - name: Setup Node.js ${{ matrix.node-version }} - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0 - with: - node-version: ${{ matrix.node-version }} - - - name: Configure npm loglevel - run: | - npm config set loglevel error - shell: bash - - - name: Install dependencies - run: npm install - - - name: Output Node and NPM versions - run: | - echo "Node.js version: $(node -v)" - echo "NPM version: $(npm -v)" - - - name: Run tests - shell: bash - run: npm run test-ci - - - name: Upload code coverage - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0 - with: - name: coverage-node-${{ matrix.node-version }}-${{ matrix.os }} - path: ./coverage/lcov.info - retention-days: 1 - - coverage: - needs: test - runs-on: ubuntu-latest - permissions: - contents: read - checks: write - steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - with: - persist-credentials: false - - - name: Install lcov - shell: bash - run: sudo apt-get -y install lcov - - - name: Collect coverage reports - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 - with: - path: ./coverage - pattern: coverage-node-* - - - name: Merge coverage reports - shell: bash - run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./lcov.info - - - name: Upload coverage report - uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6 - with: - file: ./lcov.info diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml deleted file mode 100644 index 9cbd5448..00000000 --- a/.github/workflows/scorecard.yml +++ /dev/null @@ -1,72 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. They are provided -# by a third-party and are governed by separate terms of service, privacy -# policy, and support documentation. - -name: Scorecard supply-chain security -on: - # For Branch-Protection check. Only the default branch is supported. See - # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection - branch_protection_rule: - # To guarantee Maintained check is occasionally updated. See - # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained - schedule: - - cron: '16 21 * * 1' - push: - branches: [ "master" ] - -# Declare default permissions as read only. -permissions: read-all - -jobs: - analysis: - name: Scorecard analysis - runs-on: ubuntu-latest - permissions: - # Needed to upload the results to code-scanning dashboard. - security-events: write - # Needed to publish results and get a badge (see publish_results below). - id-token: write - # Uncomment the permissions below if installing in a private repository. - # contents: read - # actions: read - - steps: - - name: "Checkout code" - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - with: - persist-credentials: false - - - name: "Run analysis" - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 - with: - results_file: results.sarif - results_format: sarif - # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: - # - you want to enable the Branch-Protection check on a *public* repository, or - # - you are installing Scorecard on a *private* repository - # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. - # repo_token: ${{ secrets.SCORECARD_TOKEN }} - - # Public repositories: - # - Publish results to OpenSSF REST API for easy access by consumers - # - Allows the repository to include the Scorecard badge. - # - See https://github.com/ossf/scorecard-action#publishing-results. - # For private repositories: - # - `publish_results` will always be set to `false`, regardless - # of the value entered here. - publish_results: true - - # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF - # format to the repository Actions tab. - - name: "Upload artifact" - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0 - with: - name: SARIF file - path: results.sarif - retention-days: 5 - - # Upload the results to GitHub's code scanning dashboard. - - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v3.29.5 - with: - sarif_file: results.sarif