[BUG-35] PR CI never runs tests

[shroy]

Severity: P0 (systemic) · Batch: B1 (test-integrity + CI)

Location

.github/workflows/pr-check.yml — checks only version-bump + changelog; tests run solely via prepublishOnly. Also "test": "vitest" relies on CI auto-detection to avoid watch mode.

Proposed fix

Add a PR job running vitest run (+ the Node-ESM smoke test from BUG-5: node --input-type=module -e "await import('./index.js')").

Verification recipe

Read .github/workflows/pr-check.yml and confirm no test execution step exists in any PR-triggered workflow.

[shroy]

Phase 1 verification: CONFIRMED

Method: static analysis (CI config — a GitHub Actions trigger graph cannot be exercised in vitest, so per the audit's own guidance this is verified by quoting exact workflow lines).

Finding

.github/workflows/pr-check.yml is the only pull_request-triggered workflow, and it never executes tests. Tests run in CI only on push-to-main (publish.yml) and on release (npm-publish.yml), plus locally via prepublishOnly. Consequently a PR that breaks the test suite passes every required PR check.

Lines of evidence

.github/workflows/pr-check.yml — the ONLY PR-triggered workflow; its only code-running steps are the version + changelog checks, no test execution:

name: PR Version & Changelog Check

on:
  pull_request:
    branches: [main]

jobs:
  version-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Check version bump          # step 1 — no tests
        run: | ...
      - name: Check changelog entry        # step 2 — no tests
        run: | ...

(full file is 42 lines; the last step ends at line 42. There is no vitest / npm test step.)

grep -rniE 'pull_request|vitest|npm test|npm run test|yarn test' .github/workflows/ — every test invocation lives in a NON-PR workflow:

.github/workflows/pr-check.yml:4:      pull_request:      <- PR trigger, but...
.github/workflows/publish.yml:42:     run: npm test      <- on: push [main] + workflow_dispatch
.github/workflows/npm-publish.yml:19: - run: npm test      <- on: release: [created]

• publish.yml:3-6 → on: push: branches: [main] + workflow_dispatch (not PRs).
• npm-publish.yml:6-8 → on: release: types: [created] (not PRs).

Secondary claim also holds — package.json:50:

"test": "vitest",

Bare vitest starts watch mode interactively; it only exits after one run because Vitest auto-detects CI. So even a hypothetical PR job calling npm test (rather than vitest run) would be fragile.

Interpretation

The premise is exactly correct: no pull_request-triggered workflow contains any test-execution step. Test coverage in CI is confined to push-to-main, release, and prepublishOnly, so broken tests introduced in a PR are not caught before merge. Verified statically because GitHub Actions trigger routing has no meaningful runtime reproduction in a vitest/jsdom process.