Distillation

Date: Aug 26, 2026

• 🔴 (13:54) User directive reaffirmed: Always use pnpm for package management.
• 🔴 (13:54) User directive reaffirmed: Never use npm or yarn.
• 🟡 (13:54) Craft added untracked test file src/__tests__/action.test.ts (144 lines), importing Node fs, os, path, child_process, js-yaml, and Vitest to execute individual composite-action shell steps from action.yml.
• 🟡 (13:54) src/__tests__/action.test.ts defines ActionStep with optional env, name, and run; getActionSteps() parses action.yml via load(readFileSync(join(__dirname, '../../action.yml'), 'utf8')) and returns action.runs?.steps || []; getActionStep(name) finds a named step and throws Error(\Missing ${name} action step`)if it lacksrun`.
• 🟡 (13:54) Action-test harness createActionEnvironment() creates /tmp temporary directories prefixed craft-action-test-, creates fake executable bin/craft and bin/git, records Craft calls in craft-calls, Git calls in git-calls, and GitHub output in github-output; afterEach() recursively removes all tracked temporary directories.
• 🟡 (13:54) Fake craft executable logs "$*" to $CRAFT_CALLS and outputs ["github"] when first argument is targets; fake git executable logs "$*" to $GIT_CALLS.
• 🟡 (13:54) runActionStep(stepName, workspace, environment) invokes bash -e -c on the named action.yml step’s run script in the temporary directory, setting CRAFT_CALLS, CRAFT_CONFIG_FROM_MERGE_TARGET='', GITHUB_OUTPUT, GIT_CALLS, MERGE_TARGET='', PATH prefixed with fake binaries, VERSION='', and WORKSPACE.
• 🟡 (13:54) src/__tests__/action.test.ts test passes option-looking workspace names inline to Craft uses workspace --config-from=untrusted, runs Craft Prepare and Read Craft Targets, expects both status 0, and asserts exact fake-Craft calls: prepare --workspace=--config-from=untrusted then targets --workspace=--config-from=untrusted.
• 🟡 (13:54) src/__tests__/action.test.ts test forwards workspace input to every Craft command asserts Craft Prepare and Read Craft Targets each have env.WORKSPACE === '${{ inputs.workspace }}'.
• 🟡 (13:54) src/__tests__/action.test.ts parameterized test rejects %s characters before every action side effect covers: control workspace cli\tnext; format workspace cli\u202enext; line separator workspace cli\u2028next; and paragraph separator workspace cli\u2029next. It asserts the first action step is Validate workspace, executing that step exits status 1, and no fake Git or Craft calls occur.
• 🟡 (13:54) src/__tests__/action.test.ts parameterized test accepts safe workspace input %j asserts Validate workspace exits status 0 for legacy empty workspace '' and valid Unicode workspace cli-日本語.