chore: simplify-review fixes — date-ref, enum source-of-truth, TOCTOU guard#43
Merged
Conversation
… guard
Three findings from the /simplify review of this session's changes:
1. .github/workflows/ci.yml — remove '(see 2026-05-21 modernization audit)'
from the npm-audit comment. Task dates belong in commit messages and PR
bodies, not in shipped code. Reworded the rationale to explain WHY the
threshold is moderate (overrides patch MCP SDK transitives) rather than
referencing the audit doc.
2. src/mcp-schemas.ts — derive zod enum tuples from the audit*.ts union
types via 'as const satisfies readonly T[]' for ShipVerdict, WorkflowKind,
ConfidenceLevel, CdStatus, CdVerdict, DestinationName, CheckStatus, and
SecurityCheckName. The compile-time check catches typos and array-extra
drift. Type-extra drift (new variant added in audit*.ts but not mirrored
here) still surfaces at runtime as a structured-content validation error
on first emission, which is loud — not silent — drift.
3. .github/workflows/update-changelog.yml — guard against duplicate-PR
races when a release is re-published. If the per-tag branch
'chore/changelog-${TAG}' already exists, exit with a notice instead
of force-pushing or failing the workflow.
Skipped findings (documented as acceptable):
- 'as unknown as Record<string, unknown>' cast in src/index.ts: unavoidable
with current SDK signature + our strongly-typed AuditReport interfaces.
- ci.yml matrix gating via 'if: matrix.node-version == 22': 4 instances of
a 1-line conditional; splitting into a separate lint job would add job
cold-start overhead and a publish.yml dependency change for no net win.
- tsconfig 'incremental: true' + tsbuildinfo cache: codebase too small for
measurable benefit.
heznpc
enabled auto-merge (squash)
May 20, 2026 23:44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes from the
/simplifyreview of this session's 7 prior PRs.Fixed
.github/workflows/ci.yml(see 2026-05-21 modernization audit)— task dates belong in commit messages, not shipped code. Reworded rationale to explain why the audit threshold is moderate.src/mcp-schemas.tsas const satisfies readonly T[]. Single source of truth forShipVerdict,WorkflowKind,ConfidenceLevel,CdStatus,CdVerdict,DestinationName,CheckStatus,SecurityCheckName..github/workflows/update-changelog.ymlchore/changelog-${TAG}branch already exists (re-published release, workflow re-run), exit with a notice instead of force-pushing or failing.Skipped (acceptable as-is)
as unknown as Record<string, unknown>cast insrc/index.ts— unavoidable with current SDK signature + our strongly-typedAuditReportinterfaces.ci.ymlmatrix gating viaif: matrix.node-version == 22— 4 instances of a 1-line conditional; splitting into a separate lint job adds job cold-start overhead for no net win on a 2-version matrix.tsconfig "incremental": true+.tsbuildinfocache — codebase too small for measurable benefit.Test plan
npm run buildcleannpm test— 85/85 passsatisfieschecks compile against current audit*.ts types