fix: release hardening before v0.1.0 (#46, #47, #49, #50) - #75
Merged
Conversation
Nothing read it: no build step, script, workflow, or doc referenced `github-profile/`, and it sits outside `src/` and `public/` so Astro never saw it. Meanwhile all four workflows check out `submodules: recursive`, which made `textrefs/.github` a hard dependency of data, linkcheck, pages and release for a directory with no consumer. Removing it before the tag matters because v0.1.0 freezes `.gitmodules`: anyone checking out the tag would otherwise inherit that dependency.
`scripts/compile.ts` requires it at build time through `scripts/source-schema.ts`, so it is a runtime dependency of the compiler, not a development tool. CI installs with `npm ci`, which includes devDependencies, so nothing broke today — but any `--omit=dev` install path would have failed at compile. Also drops the direct `@astrojs/markdown-satteri` devDependency: nothing imports it, and both astro and starlight already depend on it.
A licence value the compiler could not map to an SPDX IRI was dropped from the published record with a console warning, leaving the build green. A typo such as `CC-BY-4` for `CC-BY-4.0` silently removed the licence statement from a record whose entire value is machine-readable claims — and registry#9 already had to clean one round of these by hand. `ResolverEntrySource` now validates `license` against the SPDX id set, so an unmappable value fails the build and names the file. The emit path keeps a defensive throw for callers that bypass the parser. The SPDX set moves to source-schema.ts, which is now its only definition.
ADR-0003 says draft records are rendered noindex and excluded from search and the sitemap. The first two shipped; the sitemap did not, so a production build advertised every draft record — 67,959 references and their work, system and mapping pages — as crawlable URLs that carry no persistence promise and may be retracted outright. Starlight registers `@astrojs/sitemap` only when the project has not, so the integration is now declared explicitly with a filter. The predicate is derived from record status rather than from a route prefix, so it narrows on its own as records are promoted to active instead of permanently hiding pages that have earned a place in the sitemap. `npm test` now also picks up `src/lib/*.test.ts`.
maehr
force-pushed
the
fix/release-hardening
branch
from
August 12, 2026 21:05
78ac095 to
de61be5
Compare
There was a problem hiding this comment.
Pull request overview
This PR hardens the repository ahead of the v0.1.0 tag by removing an unused submodule dependency from CI, ensuring draft record pages are excluded from the generated sitemap (per ADR-0003/0004), and tightening license validation so non-SPDX values fail the build instead of being silently omitted.
Changes:
- Add a registry-derived
noindexpredicate and apply it to@astrojs/sitemapfiltering, with fixture-backed tests. - Validate resolver
licensevalues against the SPDX id set at source-parse time, and fail hard if an invalid value reaches emit time; add tests for both valid/invalid cases. - Move
spdx-license-idsto runtime dependencies, add an explicit@astrojs/sitemapdependency, remove an unused@astrojs/markdown-satteripin, and drop the unusedgithub-profilesubmodule.
Reviewed changes
Copilot reviewed 9 out of 10 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
src/lib/noindex.ts |
Builds a pathname predicate to identify draft-derived pages for noindex/sitemap exclusion. |
src/lib/noindex.test.ts |
Fixture-backed tests for sitemap exclusion behavior. |
astro.config.mjs |
Registers @astrojs/sitemap explicitly with a filter using the new predicate. |
scripts/source-schema.ts |
Adds SPDX id set and validates license via Zod refinement at parse time. |
scripts/compile.ts |
Reuses SPDX_IDS and turns invalid license values into hard failures (defensive check). |
scripts/compile.test.ts |
Adds tests asserting SPDX license IRI emission and invalid license build failure. |
package.json |
Updates test globbing; moves spdx-license-ids to dependencies; adds @astrojs/sitemap; removes unused pin. |
package-lock.json |
Lockfile updates reflecting dependency moves/additions/removals. |
.gitmodules |
Removes the unused github-profile submodule entry. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+6
to
+12
| process.env.TEXTREFS_REGISTRY_FIXTURE = '1'; | ||
|
|
||
| import { test } from 'node:test'; | ||
| import assert from 'node:assert/strict'; | ||
| import { buildNoindexPredicate } from './noindex.js'; | ||
|
|
||
| const isNoindex = buildNoindexPredicate(); |
This was referenced Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four issues found while reviewing #4 that are cheaper to fix before the tag than after it. Reviewed against #68 §4's "triage what is deliberately not in v0.1.0" — these four were pulled in, the rest stay out.
#50 — drop the
github-profilesubmoduleNothing read it, yet all four workflows clone it via
submodules: recursive. The tag freezes.gitmodules, so anyone checking outv0.1.0would inherit a hard dependency ontextrefs/.githubfor a directory with no consumer.#47 — draft record pages out of the sitemap
ADR-0003 says draft records are "noindex, excluded from sitemap and search". Two of three shipped. A production build was advertising 67,959 draft references plus their work, system and mapping pages as crawlable URLs that carry no persistence promise and may be retracted.
Starlight registers
@astrojs/sitemaponly when the project has not, so it is now declared explicitly with afilter. The predicate keys on record status, not on a route prefix — excluding/id/wholesale would keep hiding pages after they are promoted toactive. Fixture-backed tests cover both directions, which the real registry cannot (it is 100% draft under ADR-0004).#46 — non-SPDX licences fail the build
A licence the compiler could not map to an SPDX IRI was dropped from the published record with only a console warning. A typo like
CC-BY-4silently removed the licence statement; registry#9 already had to clean one round of these by hand. Now validated inResolverEntrySource, so it fails the build and names the file.Marked
!because a registry that currently authors a non-SPDXlicensewould newly fail to compile. Verified against the real registry: zero occurrences, so no data change is needed.#49 —
spdx-license-idsis a runtime dependencyThe compiler requires it at build time, so it belongs in
dependencies.npm ciinstalls devDependencies, so nothing broke today; any--omit=devpath would have. Also drops the unused direct@astrojs/markdown-satteripin.Verification
npm run verify:fastgreen — 27 tests, up from 21. Fullnpm run verifyagainst the real 67,959-reference registry runs in CI here; the sitemap assertion at real scale is part of the pre-tag check.Closes #46, closes #47, closes #49, closes #50. Part of #68.