|
1 | 1 | // Release check tests cover release validation script behavior. |
2 | 2 | import { chmodSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; |
3 | 3 | import { tmpdir } from "node:os"; |
4 | | -import { dirname, join, win32 } from "node:path"; |
| 4 | +import { dirname, join, resolve as resolvePath, win32 } from "node:path"; |
5 | 5 | import { bundledDistPluginFile, bundledPluginFile } from "openclaw/plugin-sdk/test-fixtures"; |
6 | 6 | import { describe, expect, it } from "vitest"; |
7 | 7 | import { listBundledPluginPackArtifacts } from "../scripts/lib/bundled-plugin-build-entries.mjs"; |
@@ -33,6 +33,7 @@ import {
|
33 | 33 | PACKED_CLI_SMOKE_COMMANDS, |
34 | 34 | PACKED_COMPLETION_SMOKE_ARGS, |
35 | 35 | packageNameFromSpecifier, |
| 36 | +resolvePackedTarballPath, |
36 | 37 | resolveReleaseNpmCommand, |
37 | 38 | resolveMissingPackBuildHint, |
38 | 39 | runReleaseCheckCommand, |
@@ -878,6 +879,32 @@ describe("collectPackUnpackedSizeErrors", () => {
|
878 | 879 | }); |
879 | 880 | }); |
880 | 881 | |
| 882 | +describe("resolvePackedTarballPath", () => { |
| 883 | +it("resolves one local npm pack tarball filename inside the pack destination", () => { |
| 884 | +expect( |
| 885 | +resolvePackedTarballPath("/tmp/openclaw-pack", [{ filename: "openclaw-2026.6.17.tgz" }]), |
| 886 | +).toBe(resolvePath("/tmp/openclaw-pack", "openclaw-2026.6.17.tgz")); |
| 887 | +}); |
| 888 | + |
| 889 | +it("rejects path-like npm pack tarball filenames", () => { |
| 890 | +const unsafeFilenames = [ |
| 891 | +"../openclaw.tgz", |
| 892 | +"nested/openclaw.tgz", |
| 893 | +"nested\\openclaw.tgz", |
| 894 | +"/tmp/openclaw.tgz", |
| 895 | +"C:\\temp\\openclaw.tgz", |
| 896 | +"openclaw\u0000.tgz", |
| 897 | +"openclaw.tar.gz", |
| 898 | +]; |
| 899 | + |
| 900 | +for (const filename of unsafeFilenames) { |
| 901 | +expect(() => resolvePackedTarballPath("/tmp/openclaw-pack", [{ filename }])).toThrow( |
| 902 | +"release-check: npm pack reported unsafe tarball filename", |
| 903 | +); |
| 904 | +} |
| 905 | +}); |
| 906 | +}); |
| 907 | + |
881 | 908 | describe("collectCriticalPluginSdkEntrypointSizeErrors", () => { |
882 | 909 | it("flags oversized public plugin SDK entrypoints before publish", () => { |
883 | 910 | const root = mkdtempSync(join(tmpdir(), "release-check-critical-sdk-")); |
|
