ci: land PR #4 (workflow hardening, Dependabot, coverage) on main - #5
Merged
Conversation
CI hardening - `npm ci` only. The previous `npm ci || npm install` fallback would silently ignore the committed lockfile and test a different dependency tree than the one we publish. - Add `permissions: contents: read`, scoping the default GITHUB_TOKEN to what the job needs. publish.yml already did this; ci.yml did not. - Pin actions to exact commit SHAs instead of mutable tags. A tag can be repointed at new code; a SHA cannot. Both actions were three majors behind, so they are upgraded first and then pinned — checkout v4 -> v7.0.1, setup-node v4 -> v7.0.0. publish.yml's pins were stale at v4.2.2/v4.4.0 and move to the same SHAs. - Run `npm run test:coverage`, failing the build below 99% lines / 90% branches / 90% functions, so coverage cannot silently regress. Dependabot - Weekly npm and github-actions updates. Minor/patch are grouped into one PR to keep the noise down; majors stay separate, since @google-cloud/bigquery v9 showed a major can carry a consumer-visible Node floor change that deserves its own review. - ultra_cart_rest_api_v2 is ignored: it is a peer dependency whose declared range already admits every 4.x, so a lockfile bump changes nothing for consumers. - Dependabot understands SHA pins and bumps the trailing "# vX.Y.Z" comment along with them, so pinning does not mean going stale. Test coverage: 20 -> 42 tests, 97.89% -> 100% lines, 82.17% -> 92.31% branches. Gaps closed, each a real untested behavior rather than a line-count exercise: - resolveDataset() was entirely untested despite being public API — the full linked x taxonomy matrix, plus agreement with the exported constants. - Constructor error path: neither merchantId nor projectId now fails loudly in a test, instead of deriving a bad project id and failing at query time. - query() without a model returning plain objects — documented, never verified. - Named parameters reaching createQueryJob. These are the library's alternative to interpolating SQL; nothing asserted they survived the call. - pageSize defaulting and both override levels. - dryRun() with no byte statistics, which previously risked NaN in a cost estimate. - REPEATED scalar columns and bare (unwrapped) primitive-array elements. - diffTrees recursion into nested records. This was the notable one: no test descended past the top level, so drift *inside* a nested record — the shape most warehouse PII lives in — would have gone unreported. - A public API surface test pinning the package entry point, so an export cannot be removed or renamed without a test failing. The one remaining uncovered function is the default `readFile` in buildSdkTree, which exists so tests can inject a fake filesystem; exercising it would mean reading real SDK files from disk. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ci: harden workflows, add Dependabot, close test coverage gaps
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why this PR exists
#4 was merged, but its changes never reached
main. It was stacked withfeat/node-22-bigquery-v9as its base, and the merge order made that base a dead end:By the time #4 merged, its base branch had already been merged and was no longer feeding
main, so #4's two commits landed there and stopped. Both PRs read MERGED, which makes this easy to miss —mainis simply missing.github/dependabot.yml, the hardenedci.yml, and 22 of the 42 tests.GitHub auto-retargets a stacked PR only when the base branch is deleted on merge. The base was kept, so no retarget happened. My note on #4 said it would retarget automatically — that was wrong, and this PR is the correction.
What's in it
Nothing new. This is #4's diff verbatim, re-based onto
main—git diff main..feat/node-22-bigquery-v9is exactly the 10 files below, since #3's content is already onmain..github/dependabot.yml.github/workflows/ci.ymlnpm ci,permissions: contents: read, SHA-pinned actions, coverage thresholds.github/workflows/publish.ymlCONTRIBUTING.mdnpm run test:coveragepackage.jsontest:coveragescripttest/*See #4 for the full rationale on each.
After merging
Delete the branch this time —
feat/node-22-bigquery-v9is serving as the head here only because that's where the commits ended up.🤖 Generated with Claude Code