From 902ada1623b8eb43b6ef62053acf4a6b3965d266 Mon Sep 17 00:00:00 2001 From: codex-bot-andresmgsl Date: Mon, 31 Aug 2026 20:06:46 +0000 Subject: [PATCH 1/2] fix: enforce package lock version parity --- package-lock.json | 4 ++-- test/governance.test.js | 10 ++++++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/package-lock.json b/package-lock.json index 821d1e2..30a980a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "stoke", - "version": "1.3.0", + "version": "1.4.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "stoke", - "version": "1.3.0", + "version": "1.4.0", "license": "ISC", "dependencies": { "commander": "^15.0.0" diff --git a/test/governance.test.js b/test/governance.test.js index 85607c8..1d64884 100644 --- a/test/governance.test.js +++ b/test/governance.test.js @@ -11,6 +11,8 @@ const REPOSITORY_CONFIG = path.join(__dirname, '..', '.github', 'labels.conf'); const REPOSITORY_LABELER = path.join(__dirname, '..', '.github', 'labeler.yml'); const REPOSITORY_MIRROR = path.join(__dirname, '..', '.ceremony'); const ROOT_AGENTS = path.join(__dirname, '..', 'AGENTS.md'); +const PACKAGE_MANIFEST = path.join(__dirname, '..', 'package.json'); +const PACKAGE_LOCK = path.join(__dirname, '..', 'package-lock.json'); const CEREMONY_REPOSITORY = 'https://forgejo.heavyduty.builders/heavy-duty/ceremony'; const CEREMONY_VERSION = '0.6.3'; const CEREMONY_WORKFLOWS = ['labels.yml', 'labels-sweep.yml']; @@ -134,6 +136,14 @@ test('repository scope mapping covers every configured scope with the ruled path } }); +test('package lock versions match the package manifest', () => { + const manifest = JSON.parse(fs.readFileSync(PACKAGE_MANIFEST, 'utf8')); + const lock = JSON.parse(fs.readFileSync(PACKAGE_LOCK, 'utf8')); + + assert.equal(lock.version, manifest.version, 'package-lock.json version is stale'); + assert.equal(lock.packages[''].version, manifest.version, 'package-lock.json root package version is stale'); +}); + test('repository carries the complete Forgejo 0.6.3 doctrine mirror and root router', () => { const vendored = ['AGENTS.md', 'TRIAGE.md', 'BUILDER.md', 'REVIEWER.md', 'LABELS.md', 'RELEASES.md']; for (const filename of vendored) { -- 2.45.2 From 125bc04edea41375dfdcec342d413297d71a81d5 Mon Sep 17 00:00:00 2001 From: codex-bot-andresmgsl Date: Mon, 31 Aug 2026 20:09:37 +0000 Subject: [PATCH 2/2] docs: record lockfile parity guard --- changelog.d/43.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 changelog.d/43.md diff --git a/changelog.d/43.md b/changelog.d/43.md new file mode 100644 index 0000000..140696c --- /dev/null +++ b/changelog.d/43.md @@ -0,0 +1 @@ +- Keep package-lock metadata aligned with the package version and guard against future drift. (#43). -- 2.45.2