(maka) 02/02: test(release): avoid pinning Nightly audit implementation

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

Astro-Han pushed a commit to branch fix/nightly-audit-boundary
in repository https://gitbox.apache.org/repos/asf/maka.git

commit b271e4f81a4e175e0d6ac1cda03cc13798e9ce66
Author: AstroHan <le...@outlook.com>
AuthorDate: Fri Sep 4 09:55:25 2026 +0800

    test(release): avoid pinning Nightly audit implementation
    
    Generated-by: Codex
---
 scripts/desktop-nightly-workflow-policy.test.mjs | 25 ------------------------
 1 file changed, 25 deletions(-)

diff --git a/scripts/desktop-nightly-workflow-policy.test.mjs b/scripts/desktop-nightly-workflow-policy.test.mjs
index 6b0f72c959..5c561cf47d 100644
--- a/scripts/desktop-nightly-workflow-policy.test.mjs
+++ b/scripts/desktop-nightly-workflow-policy.test.mjs
@@ -57,31 +57,6 @@ test('npm publication owns both npm channels and no Desktop authority', async ()
   assert.doesNotMatch(JSON.stringify(workflow), /NODE_AUTH_TOKEN|NPM_TOKEN/u);
 });
 
-test('Nightly packaging does not depend on the registry audit service', async () => {
-  const formal = await readWorkflow('release-cli-stage.yml');
-  assert.equal(formal.jobs.validate.with.package_version, undefined);
-
-  const nightlyWorkflows = [
-    await readWorkflow('npm-publication.yml'),
-    await readWorkflow('desktop-nightly.yml'),
-  ];
-  const desktop = nightlyWorkflows[1];
-  const commands = desktop.jobs.desktop.steps
-    .map((step) => step.run)
-    .filter((run) => typeof run === 'string')
-    .join('\n');
-  assert.doesNotMatch(commands, /npm audit|audit-shipped-dependencies/u);
-
-  for (const workflow of nightlyWorkflows) {
-    const installs = Object.values(workflow.jobs)
-      .flatMap((job) => job.steps ?? [])
-      .flatMap((step) => (typeof step.run === 'string' ? step.run.split('\n') : []))
-      .filter((command) => command.trimStart().startsWith('npm ci'));
-    assert.ok(installs.length > 0);
-    for (const install of installs) assert.match(install, /--no-audit/u);
-  }
-});
-
 test('Desktop Nightly starts only from a successful published npm identity', async () => {
   const workflow = await readWorkflow('desktop-nightly.yml');
   assert.deepEqual(workflow.on, {


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org