From 56aae9c148bbcd635a2d5c6a2856a8516d0eb7b1 Mon Sep 17 00:00:00 2001 From: VietKing Date: Mon, 21 Sep 2026 15:37:00 +0700 Subject: [PATCH] test(ship): give Verify_JSON an isolated root so it passes on main TestCmd_Subcommand_Verify_JSON ran `verify` without --root, so it inspected the checkout it runs in. Since 1.10.8 ship warns "nothing to ship" on any checkout with no diff against main, so the test passed on branches with unmerged commits and failed on main itself: at 22ff658 (the v1.10.8 release commit), at v1.10.9, and in the nightly macOS/Windows jobs. Use t.TempDir() as the root, as the neighbouring tests do. Verified: fails without the change on a main checkout, passes with it; the whole cmdship package passes under -race. Co-Authored-By: Claude Sonnet 5 Signed-off-by: VietKing --- CHANGELOG.md | 4 ++++ internal/cli/cmdship/ship_test.go | 6 +++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7c5dfae..a51babf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,10 @@ All notable changes to forge will be documented in this file. Format follows [Ke ## [Unreleased] +### Fixed + +- **`TestCmd_Subcommand_Verify_JSON` failed on any checkout with no diff against `main`** (the nightly macOS/Windows jobs, and any branch already merged). It ran `verify` without `--root`, so it inspected the checkout itself, and since 1.10.8 `ship` warns "nothing to ship" there. The test now uses an isolated `t.TempDir()` root like its sibling tests. Test-only; no behaviour change. + ## [1.10.9] — 2026-09-21 — `forge scan security` stops failing on test fixtures, and `.forge/waivers` is finally honoured Both fixes were found running `forge scan security` on a real Next.js/Supabase repo, where it exited non-zero on 56 findings that were all placeholders. Patch release: bug fixes plus one additive result field (`waived`); no breaking change. diff --git a/internal/cli/cmdship/ship_test.go b/internal/cli/cmdship/ship_test.go index 4b903d5..04fbf93 100644 --- a/internal/cli/cmdship/ship_test.go +++ b/internal/cli/cmdship/ship_test.go @@ -144,7 +144,11 @@ func TestCmd_Subcommand_Verify_JSON(t *testing.T) { var out, errBuf bytes.Buffer cmd.SetOut(&out) cmd.SetErr(&errBuf) // keep stderr separate so deprecation notice doesn't corrupt stdout JSON - cmd.SetArgs([]string{"verify", "--json"}) + // A fresh, isolated root: without --root, verify inspects the checkout the test + // runs in, and since 1.10.8 ship warns "nothing to ship" on any checkout with no + // diff against main (the nightly on main, and any branch already merged) — so the + // test only passed on branches with unmerged changes. + cmd.SetArgs([]string{"verify", "--json", "--root", t.TempDir()}) if err := cmd.Execute(); err != nil { t.Fatalf("verify subcommand failed: %v\n%s", err, out.String()) }