Skip to content

refactor: convert skipped tests to todo items in TrackingClient#413

Merged
devakesu merged 2 commits into1.8.0from
copilot/sub-pr-398-another-one
Feb 18, 2026
Merged

refactor: convert skipped tests to todo items in TrackingClient#413
devakesu merged 2 commits into1.8.0from
copilot/sub-pr-398-another-one

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Feb 18, 2026

Description

Skipped test suites (it.skip) with full implementations add maintenance cost without providing coverage. Converted them to it.todo() to signal planned work while removing non-functional code.

Type of Change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update
  • Code refactoring
  • Performance improvement
  • Test updates

Related Issues

Changes Made

  • Replaced 2 it.skip() tests with it.todo() in TrackingClient.test.tsx
  • Removed 96 lines of non-functional test implementation code
  • Preserved TODO comment explaining async rendering blocker

Before:

it.skip('should display "record" for count of 1', async () => {
  // 40+ lines of mocks, setup, and assertions that never run
});

After:

it.todo('should display "record" for count of 1');

Version Bump

  • Version automatically bumped by workflow (same-repo PRs)
  • Version manually bumped using node scripts/bump-version.js (fork PRs)
  • Version already up-to-date (no bump needed)

Testing

Test Environment

  • Node version: 20.x
  • npm version: 10.x
  • OS: Ubuntu

Tests Performed

  • Unit tests pass (npm run test)
  • E2E tests pass (npm run test:e2e)
  • Linting passes (npm run lint)
  • Manual testing completed

Test Coverage

Tests now properly report as "2 todo" instead of "2 skipped" when running the TrackingClient test suite.

Documentation

  • Documentation updated (if needed)
  • Code comments added for complex logic
  • API documentation updated (if API changes)

Checklist

  • My code follows the project's code style
  • I have performed a self-review of my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings or errors
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged and published

Screenshots (if applicable)

N/A

Additional Notes

This addresses review feedback from PR #398 requesting conversion of skipped tests to reduce ongoing maintenance burden.


For maintainers:

  • PR title follows conventional commit format
  • Version bump is correct
  • All checks pass
  • Documentation is complete
  • Ready to merge

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Copilot AI mentioned this pull request Feb 18, 2026
10 tasks
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>
Copilot AI changed the title [WIP] Update to version 1.8.0 with build transparency and security features refactor: convert skipped tests to todo items in TrackingClient Feb 18, 2026
Copilot AI requested a review from devakesu February 18, 2026 15:16
@devakesu devakesu marked this pull request as ready for review February 18, 2026 15:21
Copilot AI review requested due to automatic review settings February 18, 2026 15:21
@devakesu devakesu merged commit 944d5d5 into 1.8.0 Feb 18, 2026
@devakesu devakesu deleted the copilot/sub-pr-398-another-one branch February 18, 2026 15:21
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR refactors test maintenance by converting two skipped test cases to todo items in the TrackingClient test suite. The change addresses feedback from PR #398 and follows the established convention of using it.todo() instead of it.skip() for deferred tests, reducing maintenance burden by removing 96 lines of non-functional test implementation code that was never executed.

Changes:

  • Converted 2 it.skip() tests to it.todo() in TrackingClient.test.tsx
  • Removed 96 lines of mock setup and assertions that were never running
  • Updated TODO comment for better clarity about the async rendering blocker

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

devakesu added a commit that referenced this pull request Feb 18, 2026
* feat: v1.8.0 - build transparency, security hardening, and documentation overhaul

BREAKING CHANGES:
- Documentation structure reorganized: 8 separate docs merged into 2 comprehensive guides

FEATURES:
- Add /build-info page with terminal-style UI for build provenance transparency
  * Display build metadata (version, commit SHA, timestamp, GitHub run details)
  * Show security audit status (Trivy scan results)
  * Show SLSA attestation status with links to GitHub artifacts
  * Add direct links to source code, build logs, attestations, and security scorecard
  * Include educational "What is Build Provenance?" section
  * Handle dev/production modes with appropriate placeholders

- Enhance /api/provenance endpoint with 7 new fields:
  * github_repo: Repository identifier from build context
  * github_run_id: GitHub Actions run ID for traceability
  * github_run_number: Human-readable run number
  * build_timestamp: ISO 8601 build timestamp
  * audit_status: Trivy scan result (PASSED/SKIPPED/UNKNOWN)
  * signature_status: Attestation status (SIGNED/UNSIGNED/SLSA_PROVENANCE_GENERATED)
  * image_digest: Docker image digest (fallback to commit SHA in dev)

- Add dependency security overrides with full CVE documentation:
  * tar@^7.5.6: Fix path traversal vulnerabilities (5 CVEs from 2021)
  * fast-xml-parser@^5.3.4: Fix XXE and prototype pollution
  * js-yaml@^4.1.1: Fix code execution vulnerability (CVE-2021-23343)
  * glob@^13.0.4: Performance and security hardening
  * source-map@^0.7.6: Dependency resolution conflicts
  * Selective overrides for @Redocly packages: ajv@^8.18.0 (CVE-2025-69873 ReDoS)

PERFORMANCE:
- Enable gzip compression in Next.js config (70-90% size reduction)
- Add Node.js memory limit: 2.5GB heap for 4GB server optimization
- Configure rate limiting: 30 req/10s general, 5 req/60s auth endpoints
- Existing protections: Circuit breaker, request deduplication, max 3 concurrent Ezygo calls

DOCUMENTATION:
- Create docs/DEVELOPER_GUIDE.md (701 lines):
  * Consolidates: VERSIONING.md, GPG_SETUP.md, GPG_QUICK_START.md, COSIGN_VERIFICATION.md,
    BOT_PAT_SETUP.md, BUILD_PERFORMANCE.md
  * Comprehensive development setup, versioning, release process, and verification guides
  * All version references use vX.Y.Z placeholders to prevent outdated examples

- Create docs/EZYGO_INTEGRATION.md (363 lines):
  * Consolidates: EZYGO_RATE_LIMITING.md, EZYGO_VERIFICATION.md
  * Documents three-layer protection system for Ezygo API
  * Performance characteristics and verification procedures

- Enhance SECURITY.md (+235 lines):
  * Add "Dependency Security Overrides" section documenting all 6 overrides
  * Add "Known Issues" section with CVE-2025-69873 mitigation details for ESLint
  * Document accepted dev-only trade-off: ESLint dependencies retain older ajv
  * Document 7-day security patch SLA and maintenance policy
  * Update verification examples to use :latest tag instead of :main
  * Replace hardcoded versions with vX.Y.Z placeholders

- Update README.md:
  * Add build-info/ route to project structure
  * Add "Build Transparency 🔍" to key features
  * Update feature descriptions

- Consolidate CONTRIBUTING.md:
  * Remove redundant sections covered by DEVELOPER_GUIDE.md
  * Streamline contribution workflow
  * Update version reference examples

FIXES:
- Update footer link from /api/provenance to /build-info with "verified" label
- Fix sitemap tests after adding /build-info route (5 URLs total, different priorities)
- Remove unused asset: src/assets/bunkr.svg (0 references found)
- Update Docker image tag references from :main to :latest (aligns with release.yml)
- Add tracking-wide class to build-info heading for better letter spacing
- Fix pre-commit ESLint failure by removing global ajv override (selective overrides only)

BUILD:
- Update Dockerfile with 6 new build args (removed IMAGE_DIGEST as post-build only):
  * GITHUB_REPOSITORY, GITHUB_RUN_ID, GITHUB_RUN_NUMBER
  * BUILD_TIMESTAMP, AUDIT_STATUS, SIGNATURE_STATUS
- Update .github/workflows/release.yml:
  * Add 6 new build args to Docker build step
  * Fix IMAGE_NAME secret masking by using environment variable pattern
- Add NODE_OPTIONS="--max-old-space-size=2560" in Dockerfile (lines 207-209)
- Update .env and .example.env with rate limiting configuration

DEPENDENCIES:
- npm audit: 10 moderate vulnerabilities (all in dev-only ESLint dependencies)
- ajv <8.18.0 in ESLint: Accepted trade-off (global override breaks ESLint)
- Production dependencies: 0 vulnerabilities

DATABASE:
- Update Supabase migration: 20260212090500 → 20260217174834
- Add check_225_attendance_limit trigger function
- Update RLS policies and table structures

REFACTOR:
- Update all components to use Link from 'next/link' instead of deprecated imports
- Improve type definitions in assets.d.ts
- Standardize error handling across dashboard, notifications, and tracking clients
- Update UI component prop types for better type safety

TESTS:
- Update sitemap tests to reflect new /build-info route
- Fix test expectations for different page priority levels

* fix: address unresolved review comments from PR #398 (#399)

* Initial plan

* fix: address unresolved review comments

- Replace Link with anchor tags for external URLs in build-info page
- Add NODE_OPTIONS to builder stage for memory optimization
- Improve sitemap test description for clarity
- Document commit field as legacy for backward compatibility
- Add comment clarifying IMAGE_DIGEST fallback behavior
- Update npm integrity check from SHA-1 to SHA-256

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: align signature status, secure footer link, and fix nested interactive elements (#400)

* Initial plan

* fix: address unresolved PR #398 review comments (signature status, security, and accessibility)

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* Update docs/DEVELOPER_GUIDE.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Devanarayanan <fusion@devakesu.com>

* Update src/app/(public)/build-info/page.tsx

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Devanarayanan <fusion@devakesu.com>

* fix: secure cosign installation with version pinning and checksum verification (#405)

* Initial plan

* fix: secure cosign installation with version pinning and checksum verification

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: provenance API tests failing due to uncleared CI environment variables (#406)

* Initial plan

* fix: update provenance API route tests to clear GITHUB_RUN_ID env var

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* test: add comprehensive coverage for new provenance API fields and fallbacks (#407)

* Initial plan

* test: add comprehensive tests for new provenance fields and fallbacks

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* test: add comprehensive coverage for 91 missing lines across 6 files (#409)

* Initial plan

* Add comprehensive test suites for 6 files with missing coverage

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* Fix NotificationsClient test hover state handling

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* Fix tests to import and test actual components instead of mocks

- NotificationsClient: Test CSS hover:shadow-md class (line 47) not JS event handlers
- TrackingClient: Test ternary operator for singular/plural (line 545) using real component
- build-info: Fix error test to match actual code behavior (no res.ok check)
- AcceptTermsForm: Add test verifying redirect doesn't happen before 100ms delay

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* Fix test issues from code review

- Export hooks as vi.fn() for mock overrides to work
- Add username to user mocks for sync gate completion
- Mock sync API fetch for protected pages
- Fix tracking data shape to match TrackAttendance type
- Update button query from "delete all" to "clear all"
- Add virtual items to virtualizer mock for rendering
- Fix loading spinner query (div with class, not role="status")
- Add try/finally for fake timer cleanup
- Remove unused userEvent import from select test
- Remove unused user variable from AcceptTermsForm test
- Fix github_run_number handling in build-info test

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* Fix TypeScript and test isolation issues

- Prefix unused parameters with _ in mocks (noUnusedParameters)
- Remove unused imports (within, userEvent)
- Add fetch restoration in afterEach for test isolation
- Fix DashboardClient mocks (username, attendanceData) for sync gate
- Update virtualizer mock to include header and notification indices
- Replace /syncing/i wait with actual notification text
- Add try/finally for clipboard restoration
- Add missing user variable in AcceptTermsForm error test
- Remove unused asChild destructuring from select Icon mock

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* Add missing afterEach imports and mutation hook props

- Import afterEach in TrackingClient and DashboardClient tests
- Add mutateAsync and isPending to useSetSemester/useSetAcademicYear mocks
- Fixes ReferenceError for afterEach and runtime errors for missing mutation props

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* Fix mock APIs and remove unreachable test case

- Add measureElement and measure to virtualizer mock in NotificationsClient
- Add refetch to useAttendanceReport mock in DashboardClient
- Remove count=0 test case from TrackingClient (button only appears when count > 0)
- Plural "records" case already covered by count=2 test

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: resolve unit test failures in Select, AcceptTermsForm, and BuildInfoPage components (#410)

* Initial plan

* fix: resolve test failures in Select and AcceptTermsForm components

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: resolve test failures in BuildInfoPage, Select, and AcceptTermsForm components

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: resolve unit test failures caused by incomplete test mocks (#411)

* Initial plan

* fix: add missing mocks for @tanstack/react-query, framer-motion, Supabase, and UI components

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: skip problematic tests and add refetch mocks - all tests now passing

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: resolve PostCSS configuration error for Tailwind CSS v4 (#412)

* Initial plan

* fix: resolve PostCSS config error for Tailwind CSS v4 in e2e tests

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* refactor: convert skipped tests to todo items in TrackingClient (#413)

* Initial plan

* refactor: convert skipped tests to todo items to reduce maintenance cost

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: address PR #398 review comments - test conventions, security hardening (#414)

* Initial plan

* fix: address PR review comments - convert tests to todo, fix security issues

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: prevent checkbox toggle when clicking terms link in AcceptTermsForm (#415)

* Initial plan

* fix: prevent checkbox toggle when clicking terms link with secure window.open

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* refactor: improve link handling by preventing label toggle instead of using window.open

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: use programmatic anchor click instead of window.open for better security and accessibility

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* refactor: use fake timers for deterministic 100ms delay test (#416)

* Initial plan

* refactor: use fake timers for deterministic delay test

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* docs: improve comment explaining fireEvent vs userEvent with fake timers

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Signed-off-by: Devanarayanan <fusion@devakesu.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants