[gormaniac]

Bug

When fetching the report URL failed, doReportRequest() in slib.report.ingest.lib.storm called $lib.debug(...). $lib.debug is a boolean, so the command died with:

'boolean' object is not callable: lib.debug(`HTTP Error: {$resp.err}`)

That error replaced the package's own "Could not get the report URL!" error, and the $resp.err detail was never printed, even with --debug. This is the same bug #48 fixed in stix.

Fix

• Replace the call with if $lib.debug { $lib.print(HTTP Error: {$resp.err}) }. No $lib.debug(...) calls remain in src/pkgs.
• Add the first report-ingest tests, tests/pkgs/report_ingest/. They point the command at http://127.0.0.1:1/, where nothing listens, so the request fails without leaving the host. One test checks the warning and the package's own error. The other checks that --debug also prints the HTTP error. Both fail on main with the 'boolean' object is not callable error.
• Fix the command's help examples, which called stix.ingest instead of slib.report.ingest.
• Patch bump report-ingest 0.1.1 → 0.1.2.

Why tests and CI missed it

• Before this PR, report-ingest had no tests. StormPkgTest only loads the packages a test names, so pytest never touched it.
• make build-storm doesn't parse Storm. Building the pre-Fix stix package syntax errors, move release docs to the contribution guide #48 stix, with its syntax errors, still exits 0.
• The call is valid syntax, so a load test or Synapse's Storm linter can't catch it. Only running the failed-request path does, which the new tests do.

CI guards

These close the gaps that let stix's syntax errors through:

• tests/pkgs/test_all_pkgs.py loads every package under src/pkgs/ into a Cortex, which validates all of its Storm. It finds packages by directory (src/pkgs/<name>/<name>.yaml, as build.sh does), so new packages are covered without a test of their own. Against the pre-Fix stix package syntax errors, move release docs to the contribution guide #48 stix it reports stix.yaml: BadSyntax(...).
• make lint-storm runs python -m synapse.tools.storm.lint --select E src/pkgs, Synapse's Storm linter limited to errors. The Build, Tests, and Prepare Release workflows run it before make tests. It passes on main's packages and exits 1 on the pre-Fix stix package syntax errors, move release docs to the contribution guide #48 stix.
• The Pipfile now requires synapse>=2.256.0,<3, the first release with the linter. The library's own floor in pyproject.toml stays >=2.225.0.
• The contribution guide documents both under Testing.

GitHub Actions bump

CI warned that actions/checkout@v4 and actions/setup-python@v5 target Node.js 20, which GitHub has deprecated, so they were being forced onto Node.js 24. Every action is now pinned to its latest release, and all of them run on Node.js 24 except upload-pages-artifact, which is a composite action:

Action	Old	New
actions/checkout	v4	v7.0.1
actions/setup-python	v5	v7.1.0
actions/configure-pages	v5	v6.0.0
actions/deploy-pages	v4	v5.0.1
actions/upload-pages-artifact	v3	v5.0.0
softprops/action-gh-release	v2	v3.0.3

Every input the workflows pass (token, fetch-depth, ref, python-version, path, and the release inputs) still exists in the new versions. Breaking changes checked:

• checkout v6 keeps persisted credentials in a separate file, but git push in the same workspace still uses them, so Prepare Release's push with RELEASE_TOKEN is unaffected. v7 only blocks checking out fork PRs for pull_request_target/workflow_run, which no workflow uses.
• upload-pages-artifact v4+ leaves out hidden files by default. The pages job already copies the docs with cp -r docs/*, which skips dotfiles, so the artifact doesn't change.
• action-gh-release v3 only moves the runtime to Node.js 24.

This PR's CI runs Build and Tests on the new versions. Pages, Prepare Release, and Release only run from main or by hand, so they'll first use the new versions after merge.

Testing

• pytest tests: 35 passed. The deprecation check from tests/conftest.py is on.
• python -m synapse.tools.storm.lint --select E src/pkgs: all checks pass. In CI, the step ran through pipenv and passed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KBLBzjs3FWt5tMeTsVjC79