From 24b62cbe7192771d4016bf1b3fff0f207285f0dc Mon Sep 17 00:00:00 2001
From: Tom Boucher <trekkie@nomorestars.com>
Date: Wed, 27 May 2026 20:21:22 -0400
Subject: [PATCH] ci(#310): scope release and hotfix gates to unit coverage
 (#388)

release.yml (rc + finalize) and hotfix.yml (finalize) ran the full
`npm run test:coverage` suite on the release path, redundantly re-running
the integration/install/security/slow suites that already passed on the
PR lanes into next. Switch those three sites to `npm run test:coverage:unit`
(same c8 config, unit suite only) to cut release latency. Full-suite
coverage remains available via the dedicated lanes / `test:coverage:all`.

Adds a workflow-contract regression test asserting the release/hotfix gates
invoke the unit coverage command (exact-line match, not substring).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/hotfix.yml          |  2 +-
 .github/workflows/release.yml         |  4 +--
 tests/release-coverage-scope.test.cjs | 35 +++++++++++++++++++++++++++
 3 files changed, 38 insertions(+), 3 deletions(-)
 create mode 100644 tests/release-coverage-scope.test.cjs

diff --git a/.github/workflows/hotfix.yml b/.github/workflows/hotfix.yml
index 9d068cdd4..fd45102ea 100644
--- a/.github/workflows/hotfix.yml
+++ b/.github/workflows/hotfix.yml
@@ -320,7 +320,7 @@ jobs:
       - name: Install and test
         run: |
           npm ci
-          npm run test:coverage
+          npm run test:coverage:unit
 
 
       - name: Dry-run publish validation
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 91a1cc2ad..2dad33cce 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -191,7 +191,7 @@ jobs:
           npm ci
           chmod +x scripts/check-npm-integrity.sh
           scripts/check-npm-integrity.sh
-          npm run test:coverage
+          npm run test:coverage:unit
 
       - name: Commit pre-release version bump
         env:
@@ -324,7 +324,7 @@ jobs:
           npm ci
           chmod +x scripts/check-npm-integrity.sh
           scripts/check-npm-integrity.sh
-          npm run test:coverage
+          npm run test:coverage:unit
 
       - name: Ensure npm supports trusted publishing
         run: npm install -g npm@latest
diff --git a/tests/release-coverage-scope.test.cjs b/tests/release-coverage-scope.test.cjs
new file mode 100644
index 000000000..e336627a4
--- /dev/null
+++ b/tests/release-coverage-scope.test.cjs
@@ -0,0 +1,35 @@
+// allow-test-rule: source-text-is-the-product
+// .github/workflows/{release,hotfix}.yml are the deployed CI contract; asserting
+// the release-gate test command is only expressible against the workflow text.
+
+'use strict';
+
+const { describe, test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const RELEASE_WORKFLOW = path.join(__dirname, '..', '.github', 'workflows', 'release.yml');
+const HOTFIX_WORKFLOW  = path.join(__dirname, '..', '.github', 'workflows', 'hotfix.yml');
+
+describe('release-coverage-scope', () => {
+  test('release.yml uses test:coverage:unit (not full suite) in both rc and finalize gates', () => {
+    const lines = fs.readFileSync(RELEASE_WORKFLOW, 'utf8').split('\n').map(l => l.trim());
+    const bareCount = lines.filter(l => l === 'npm run test:coverage').length;
+    const unitCount = lines.filter(l => l === 'npm run test:coverage:unit').length;
+    assert.strictEqual(bareCount, 0,
+      `release.yml still has ${bareCount} bare 'npm run test:coverage' line(s); expected 0`);
+    assert.strictEqual(unitCount, 2,
+      `release.yml has ${unitCount} 'npm run test:coverage:unit' line(s); expected 2`);
+  });
+
+  test('hotfix.yml uses test:coverage:unit (not full suite) in the finalize gate', () => {
+    const lines = fs.readFileSync(HOTFIX_WORKFLOW, 'utf8').split('\n').map(l => l.trim());
+    const bareCount = lines.filter(l => l === 'npm run test:coverage').length;
+    const unitCount = lines.filter(l => l === 'npm run test:coverage:unit').length;
+    assert.strictEqual(bareCount, 0,
+      `hotfix.yml still has ${bareCount} bare 'npm run test:coverage' line(s); expected 0`);
+    assert.strictEqual(unitCount, 1,
+      `hotfix.yml has ${unitCount} 'npm run test:coverage:unit' line(s); expected 1`);
+  });
+});