[GH-ISSUE #3114] [Bug] Reference-source exclusion test assumes filesystem enumeration order #1082

New issue

Closed

opened 2026-10-15 18:30:55 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:30:55 +00:00

Owner

Originally created by @yogesh-43 on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3114

Observed behavior

The reference-source reader test applies exclusions to normalized paths after no-follow type inspection assumes that the filesystem enumerates ignored before kept. Node's directory enumeration does not guarantee that order. On Linux x86_64, the test failed when it observed the same two valid entries in the opposite order:

Expected: [["ignored", "directory"], ["kept", "file"]]
Received: [["kept", "file"], ["ignored", "directory"]]

Both entries were inspected, and the excluded directory was not traversed. The failure comes from the assertion's ordering requirement, not from an observed application exclusion failure.

Reproduction

npm run test:focused -- tests/boundary/filesystem/referenceSourceReader.test.ts

The failure depends on the filesystem enumeration order, so it is not guaranteed on every run or host. The observed failure occurred on the fork's baseline 41a2e846470bd2af40dd298d975b1a1d2fef5786, using Node.js 24.18.0 and npm 11.16.0. Current upstream f3534749e564421036ac445f536fc766b038208f retains the same order-sensitive assertion, as confirmed by source inspection.

Expected behavior and impact

Verify that both expected entries are inspected exactly once with their correct kinds, and that the excluded directory is not traversed. Do not require an order the filesystem does not guarantee. This avoids a false regression failure across filesystems while retaining the test's exclusion and no-follow guarantees.

REA version: 6.4.0. Area: test infrastructure for local reference-source import. No native provider is needed.

Proposed correction and accompanying review scope

Assert the exact invocation count and unordered membership, while keeping the resulting inventory assertion.
Retain compiled CLI coverage for stable missing symlink targets. Upstream already fixed the production ENOTDIR classification in 0f4c484be552a4d5e8e1d0fa072441bfa900c815; the proposed patch adds public CLI regression coverage rather than claiming to fix that behavior again.
Include the requested development-toolchain remediation: typed-rest-client pins qs 6.15.1 through Stryker. Override that specific chain to qs 6.16.0 and regenerate the lockfile/license inventory. The earlier audit reported two moderate findings; a null/undefined comma-array serialization crash was reproduced and fixed by the patched version. Direct dependency versions and runtime dependencies remain unchanged.

Implemented in PR #3117, on a branch based on upstream main at f3534749e564421036ac445f536fc766b038208f.

Executed validation on that branch: npm ci, npm run check, and npm run docs:check passed; eight focused reference-source test files passed with 58 tests passed and 2 skipped; all 1,242 test files were discovered exactly once; npm audit reported zero vulnerabilities. The full test suite and real native-provider/Windows/macOS workflows were not run.

Before submitting

Searched open and closed issues for related exclusion-order and dependency reports.
Removed credentials, private paths, and sensitive target data.

Originally created by @yogesh-43 on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3114 ## Observed behavior The reference-source reader test `applies exclusions to normalized paths after no-follow type inspection` assumes that the filesystem enumerates `ignored` before `kept`. Node's directory enumeration does not guarantee that order. On Linux x86_64, the test failed when it observed the same two valid entries in the opposite order: ```text Expected: [["ignored", "directory"], ["kept", "file"]] Received: [["kept", "file"], ["ignored", "directory"]] ``` Both entries were inspected, and the excluded directory was not traversed. The failure comes from the assertion's ordering requirement, not from an observed application exclusion failure. ## Reproduction ```bash npm run test:focused -- tests/boundary/filesystem/referenceSourceReader.test.ts ``` The failure depends on the filesystem enumeration order, so it is not guaranteed on every run or host. The observed failure occurred on the fork's baseline `41a2e846470bd2af40dd298d975b1a1d2fef5786`, using Node.js 24.18.0 and npm 11.16.0. Current upstream `f3534749e564421036ac445f536fc766b038208f` retains the same order-sensitive assertion, as confirmed by source inspection. ## Expected behavior and impact Verify that both expected entries are inspected exactly once with their correct kinds, and that the excluded directory is not traversed. Do not require an order the filesystem does not guarantee. This avoids a false regression failure across filesystems while retaining the test's exclusion and no-follow guarantees. REA version: 6.4.0. Area: test infrastructure for local reference-source import. No native provider is needed. ## Proposed correction and accompanying review scope - Assert the exact invocation count and unordered membership, while keeping the resulting inventory assertion. - Retain compiled CLI coverage for stable missing symlink targets. Upstream already fixed the production `ENOTDIR` classification in `0f4c484be552a4d5e8e1d0fa072441bfa900c815`; the proposed patch adds public CLI regression coverage rather than claiming to fix that behavior again. - Include the requested development-toolchain remediation: `typed-rest-client` pins `qs` 6.15.1 through Stryker. Override that specific chain to `qs` 6.16.0 and regenerate the lockfile/license inventory. The earlier audit reported two moderate findings; a null/undefined comma-array serialization crash was reproduced and fixed by the patched version. Direct dependency versions and runtime dependencies remain unchanged. Implemented in [PR #3117](https://github.com/morluto/rea/pull/3117), on a branch based on upstream `main` at `f3534749e564421036ac445f536fc766b038208f`. Executed validation on that branch: `npm ci`, `npm run check`, and `npm run docs:check` passed; eight focused reference-source test files passed with 58 tests passed and 2 skipped; all 1,242 test files were discovered exactly once; npm audit reported zero vulnerabilities. The full test suite and real native-provider/Windows/macOS workflows were not run. ## Before submitting - [x] Searched open and closed issues for related exclusion-order and dependency reports. - [x] Removed credentials, private paths, and sensitive target data.

bsakaguchi

2026-10-15 18:30:55 +00:00

closed this issue
added the
bug
label

bsakaguchi referenced this issue

2026-10-17 21:08:25 +00:00

[PR #1082] [MERGED] fix(artifacts): keep cpio checksum evidence and bound xar TOC elements #2630

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1082

No description provided.

Rows
Columns