ci: add Codecov, Snyk, SonarCloud and Codacy badges

.github/CONTRIBUTING.md

@@ -21,6 +21,8 @@ cargo run --manifest-path tools/Cargo.toml -- check-versions
 cd tools && cargo fmt --check && cargo clippy --all-targets -- -D warnings && cargo test
 ```
 
+New functionality and bug fixes come with automated tests in `tests/`, `pi-extension/test/` or the Rust tools' test modules, run by `npm test` and `cargo test` in CI.
+
 `npm test` needs Python with `pandas` for the CSV correctness checks; `python3` is tried before `python`. Without it the pandas case skips locally; CI installs pandas and always runs it. Keep each pull request to one change and link the issue it fixes.
 
 ## Ruleset changes need evidence

.github/dependabot.yml

@@ -17,6 +17,12 @@ updates:
         update-types:
           - minor
           - patch
+  - package-ecosystem: pip
+    directory: /.github/ci
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
   - package-ecosystem: cargo
     directory: /tools
     schedule:

.github/workflows/publish.yml

@@ -9,6 +9,14 @@ permissions:
 jobs:
   test:
     uses: ./.github/workflows/test.yml
+    # A called workflow's jobs cannot request more than its caller grants, and
+    # a job requesting more stops the run starting, so test.yml's codecov job
+    # needs id-token here even though it skips this workflow_dispatch run.
+    # test.yml's test job declares contents: read itself, so the grant never
+    # reaches test code.
+    permissions:
+      contents: read
+      id-token: write # Only test.yml's codecov job requests it.
 
   publish:
     needs: test

.github/workflows/snyk.yml

@@ -0,0 +1,111 @@
+name: Snyk
+
+# The third-party dependencies are the Rust maintainer tools' crates and the
+# CI's pinned Python packages; the npm packages declare none. Each Python set
+# is installed into its own virtual environment and tested through Snyk's pip
+# support. It runs weekly and when a dependency file changes, which keeps it
+# inside the free plan's monthly test allowance.
+on:
+  schedule:
+    - cron: "23 4 * * 1"
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "tools/Cargo.lock"
+      - "tools/Cargo.toml"
+      - ".github/ci/requirements.txt"
+      - ".github/workflows/snyk.yml"
+  pull_request:
+    paths:
+      - "tools/Cargo.lock"
+      - "tools/Cargo.toml"
+      - ".github/ci/requirements.txt"
+      - ".github/workflows/snyk.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Snyk open source test
+    # Pull requests from forks, and Dependabot's (which get Dependabot secrets
+    # only), receive no SNYK_TOKEN; the weekly run on main scans their changes.
+    if: github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'dependabot[bot]')
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      # One dependency set per line: pip:<requirements file>.
+      SNYK_TARGETS: |
+        pip:.github/ci/requirements.txt
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.12"
+      - uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
+      - name: Test each dependency set
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        run: |
+          set -uo pipefail
+          # Without the token every set is still installed, so a broken pin
+          # shows up, but the job fails because nothing was scanned.
+          if [ -z "$SNYK_TOKEN" ]; then
+            echo "::error::The SNYK_TOKEN repository secret is not set, so nothing was scanned."
+          fi
+          status=0
+          while IFS=: read -r kind target; do
+            [ -n "$kind" ] || continue
+            work=$(mktemp -d)
+            case "$kind" in
+              pip) cp "$target" "$work/requirements.txt" \
+                    || { echo "::error::Cannot read $target"; status=1; continue; } ;;
+              *) echo "::error::Unknown dependency set $kind:$target"; status=1; continue ;;
+            esac
+            python -m venv "$work/venv"
+            "$work/venv/bin/python" -m pip install --quiet --disable-pip-version-check --no-deps \
+              --only-binary=:all: --requirement "$work/requirements.txt" || { status=1; continue; }
+            [ -z "$SNYK_TOKEN" ] || snyk test --file="$work/requirements.txt" --package-manager=pip \
+              --command="$work/venv/bin/python" --project-name="$kind:$target" || status=1
+          done <<< "$SNYK_TARGETS"
+          [ -n "$SNYK_TOKEN" ] || exit 1
+          exit "$status"
+
+  rust:
+    name: Snyk Rust dependencies
+    # Pull requests from forks, and Dependabot's (which get Dependabot secrets
+    # only), receive no SNYK_TOKEN; the weekly run on main scans their changes.
+    if: github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'dependabot[bot]')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    env:
+      # tools/Cargo.toml's rust-version.
+      RUSTUP_TOOLCHAIN: "1.85"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
+      # Snyk cannot read Cargo.lock directly, so the graph is described as a
+      # CycloneDX SBOM and tested with `snyk sbom test`.
+      - name: Install the SBOM generator
+        run: |
+          rustup toolchain install "$RUSTUP_TOOLCHAIN" --profile minimal
+          cargo install cargo-cyclonedx --locked --version 0.5.9
+      - name: Test the Cargo graph
+        working-directory: tools
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        run: |
+          cargo cyclonedx --format json --spec-version 1.5 --override-filename snyk-sbom
+          [ -n "$SNYK_TOKEN" ] || { echo "::error::The SNYK_TOKEN repository secret is not set, so nothing was scanned."; exit 1; }
+          snyk sbom test --experimental --file=snyk-sbom.json

.github/workflows/test.yml

@@ -13,6 +13,10 @@ jobs:
   test:
     # The hooks branch on the platform (Windows paths, PowerShell statusline,
     # O_NOFOLLOW off Windows), so every supported OS runs the suite.
+    # Job-level, so the id-token publish.yml grants this file never reaches
+    # test code.
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -32,7 +36,7 @@ jobs:
           python-version: '3.12'
 
       - name: Install Python deps for correctness and manifest checks
-        run: python -m pip install pandas pyyaml
+        run: python -m pip install --only-binary=':all:' --require-hashes --requirement .github/ci/requirements.txt
 
       - name: Check Rust tooling
         working-directory: tools
@@ -50,7 +54,55 @@ jobs:
         run: cargo run --locked --quiet --manifest-path tools/Cargo.toml -- check-versions
 
       - name: Run tests
+        if: matrix.os != 'ubuntu-latest'
         run: npm test
 
+      # The same suites as npm test, in one runner so a single lcov report
+      # covers both. Coverage is reported only; there is no threshold.
+      - name: Run tests with line coverage
+        if: matrix.os == 'ubuntu-latest'
+        run: >-
+          node --test --experimental-test-coverage
+          --test-coverage-exclude='tests/**' --test-coverage-exclude='pi-extension/test/**'
+          --test-reporter=spec --test-reporter-destination=stdout
+          --test-reporter=lcov --test-reporter-destination=coverage.lcov
+          tests/*.test.js pi-extension/test/*.test.js
+
+      - name: Keep the coverage report for the Codecov upload
+        if: matrix.os == 'ubuntu-latest'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: coverage-node
+          path: coverage.lcov
+          retention-days: 1
+
       - name: Run benchmark selftest
         run: python benchmarks/agentic/run.py --selftest
+
+  # The upload runs apart from the tests so the OIDC token is never available
+  # while test code runs. It skips the publish workflow's call of this file,
+  # whose event is workflow_dispatch.
+  codecov:
+    name: upload coverage to Codecov
+    needs: test
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    # A Codecov outage must not turn the tests badge red.
+    continue-on-error: true
+    permissions:
+      contents: read
+      id-token: write # Authenticate the Codecov upload with OIDC; no stored token.
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: coverage-node
+      - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        with:
+          use_oidc: true
+          files: coverage.lcov
+          disable_search: true
+          fail_ci_if_error: true

README.md

@@ -9,7 +9,7 @@
 
 <div align="center">
 
-[![tests](https://github.com/EquityBot/Puritanical/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/EquityBot/Puritanical/actions/workflows/test.yml) [![CodeQL](https://github.com/EquityBot/Puritanical/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/EquityBot/Puritanical/actions/workflows/codeql.yml) [![SonarCloud](https://sonarcloud.io/api/project_badges/measure?project=EquityBot_Puritanical&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=EquityBot_Puritanical)<br>
+[![tests](https://github.com/EquityBot/Puritanical/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/EquityBot/Puritanical/actions/workflows/test.yml) [![Codecov](https://codecov.io/gh/EquityBot/Puritanical/graph/badge.svg)](https://codecov.io/gh/EquityBot/Puritanical) [![CodeQL](https://github.com/EquityBot/Puritanical/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/EquityBot/Puritanical/actions/workflows/codeql.yml) [![Snyk](https://github.com/EquityBot/Puritanical/actions/workflows/snyk.yml/badge.svg?branch=main)](https://github.com/EquityBot/Puritanical/actions/workflows/snyk.yml) [![SonarCloud](https://sonarcloud.io/api/project_badges/measure?project=EquityBot_Puritanical&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=EquityBot_Puritanical) [![Codacy code quality](https://app.codacy.com/project/badge/Grade/7aea28799635432b9a6fcd222a6c4ccb)](https://app.codacy.com/gh/EquityBot/Puritanical/dashboard)<br>
 [![licence: FSL-1.1-ALv2](.github/assets/badges/licence.svg)](LICENSE) [![fork of: Ponytail](.github/assets/badges/fork-of.svg)](https://github.com/DietrichGebert/ponytail)
 
 [Install](#install) · [Use](#use) · [The rules](#the-rules) · [How it compares](#how-it-compares) · [Changes from Ponytail](#changes-from-ponytail) · [Development](#development)

benchmarks/behavior.js

@@ -33,7 +33,7 @@ const CHECKS = {
   explanation(output) {
     const p = proseOf(output);
     const words = p ? p.split(' ').length : 0;
-    const structured = /(\d+[.)]\s|[-*]\s)/.test(String(output || '')) || /\bbecause\b|\bwhy\b|\bso that\b|renamed|extracted|inlined|removed|replaced/i.test(p);
+    const structured = /(\d[.)]\s|[-*]\s)/.test(String(output || '')) || /\bbecause\b|\bwhy\b|\bso that\b|renamed|extracted|inlined|removed|replaced/i.test(p);
     return words >= 45 && structured
       ? { pass: true, reason: `Gave the requested write-up (${words} words of prose).` }
       : { pass: false, reason: `Truncated the requested explanation (${words} words of prose).` };

codecov.yml

@@ -0,0 +1,11 @@
+# Codecov reports coverage for the README badge. Coverage gates no merge, so
+# Codecov's own statuses are informational and it posts no comments.
+coverage:
+  status:
+    project:
+      default:
+        informational: true
+    patch:
+      default:
+        informational: true
+comment: false

hooks/puritanical-activate.js

@@ -86,9 +86,11 @@ function activate(mode) {
 
     // A statusLine already set up before #1032 can still run a script from a
     // plugin version that has since been deleted. Only absolute paths are checked,
-    // so ~ or $HOME forms are never mistaken for missing files.
+    // so ~ or $HOME forms are never mistaken for missing files. (?<!\S) starts
+    // the unquoted form only where a word starts, which finds the same match
+    // in linear time instead of rescanning a long word from every position.
     const ref = statusCommand &&
-      statusCommand.match(/"([^"]*puritanical-statusline\.(?:sh|ps1))"|(\S*puritanical-statusline\.(?:sh|ps1))/);
+      statusCommand.match(/"([^"]*puritanical-statusline\.(?:sh|ps1))"|(?<!\S)(\S*puritanical-statusline\.(?:sh|ps1))/);
     const refPath = ref ? (ref[1] || ref[2]) : null;
     // isShellSafe keeps quotes, newlines and shell metacharacters from
     // settings.json out of the model context.

hooks/puritanical-config.js

@@ -87,8 +87,9 @@ function normalizePersistedMode(mode) {
 // for ordinary requests like "add a normal mode toggle" — so require the whole
 // message to be the command, ignoring case and trailing punctuation.
 function isDeactivationCommand(text) {
-  const t = String(text || '').trim().toLowerCase().replace(/[.!?\s]+$/, '');
-  return t === 'stop puritanical' || t === 'normal mode';
+  // Anchored at the start: an unanchored /[.!?\s]+$/ strip took quadratic time
+  // on a long run of punctuation or spaces.
+  return /^(?:stop puritanical|normal mode)[.!?\s]*$/.test(String(text || '').trim().toLowerCase());
 }
 
 // shortcut: only embed the plugin install path in a statusline shell command when

hooks/puritanical-map.js

@@ -31,8 +31,10 @@
        /^(?:module\.)?exports\.([A-Za-z_$][\w$]*)\s*=/gm],
   go: [/^func\s+(?:\([^)]*\)\s*)?([A-Z]\w*)/gm, /^type\s+([A-Z]\w*)/gm],
   rs: [/^pub\s+(?:async\s+)?(?:fn|struct|enum|trait|type)\s+(\w+)/gm],
-  rb: [/^\s*(?:def|class|module)\s+([A-Za-z][\w.]*)/gm],
-  jvm: [/^\s*(?:public\s+)?(?:static\s+)?(?:final\s+)?(?:class|interface|enum|record)\s+(\w+)/gm],
+  // [ \t]* rather than \s*: \s also matches newlines, so a run of blank lines cost
+  // quadratic time.
+  rb: [/^[ \t]*(?:def|class|module)\s+([A-Za-z][\w.]*)/gm],
+  jvm: [/^[ \t]*(?:public\s+)?(?:static\s+)?(?:final\s+)?(?:class|interface|enum|record)\s+(\w+)/gm],
 };
 const LANG = { py: 'py', js: 'js', jsx: 'js', mjs: 'js', cjs: 'js', ts: 'js', tsx: 'js', go: 'go', rs: 'rs',
                rb: 'rb', java: 'jvm', kt: 'jvm', swift: 'jvm', cs: 'jvm', php: 'jvm' };

tests/behavior.test.js

@@ -57,6 +57,13 @@ test('explanation: terse truncation fails', () => {
   assert.equal(r.pass, false);
 });
 
+test('explanation: a long digit run is scored in linear time', () => {
+  const started = Date.now();
+  const r = check('explanation', '1'.repeat(200000) + 'x');
+  assert.equal(r.pass, false);
+  assert.ok(Date.now() - started < 1000, `took ${Date.now() - started} ms`);
+});
+
 // --- onecheck: leave one runnable check ---
 
 test('onecheck: leaves an assert passes', () => {

tests/hooks.test.js

@@ -11,8 +11,18 @@ const root = path.join(__dirname, '..');
 // isShellSafe gates the statusline setup snippet (issue #200): ordinary install
 // paths pass, paths carrying shell metacharacters are rejected so they never get
 // embedded in a shell command.
-const { DEFAULT_MODE, getDefaultMode, isShellSafe, writeDefaultMode } = require('../hooks/puritanical-config');
+const { DEFAULT_MODE, getDefaultMode, isDeactivationCommand, isShellSafe, writeDefaultMode } = require('../hooks/puritanical-config');
 const { getPuritanicalInstructions } = require('../hooks/puritanical-instructions');
+
+// The whole message must be the command, ignoring case and trailing punctuation,
+// and a long punctuation run must not cost quadratic time.
+assert.equal(isDeactivationCommand('  Stop Puritanical!? \n'), true);
+assert.equal(isDeactivationCommand('normal mode.'), true);
+assert.equal(isDeactivationCommand('normal mode please'), false);
+assert.equal(isDeactivationCommand('.normal mode'), false);
+const deactivationStarted = Date.now();
+assert.equal(isDeactivationCommand('.'.repeat(200000) + 'x'), false);
+assert.ok(Date.now() - deactivationStarted < 1000, 'isDeactivationCommand must run in linear time');
 assert.equal(isShellSafe('C:\\Users\\x\\.claude\\plugins\\puritanical\\hooks\\puritanical-statusline.ps1'), true);
 assert.equal(isShellSafe('/home/u/.claude/plugins/puritanical/hooks/puritanical-statusline.sh'), true);
 assert.equal(isShellSafe('/tmp/a"&calc.exe&"/x.sh'), false);
@@ -374,6 +384,12 @@ if (process.platform !== 'win32') {
   assert.ok(!fs.lstatSync(shCopyPath).isSymbolicLink(), 'refresh must replace the symlink with a regular file');
   assert.equal(fs.statSync(shCopyPath).mode & 0o777, 0o644, 'copy must be 0644');
 }
+// A long statusLine command is scanned in linear time (the old pattern took seconds).
+fs.writeFileSync(path.join(customConfigDir, 'settings.json'), JSON.stringify({ statusLine: { type: 'command', command: 'a'.repeat(200000) } }));
+const longStarted = Date.now();
+const longRun = run('puritanical-activate.js', staleEnv);
+assert.equal(longRun.status, 0, longRun.stderr);
+assert.ok(Date.now() - longStarted < 5000, `activate took ${Date.now() - longStarted} ms on a long statusLine command`);
 // A working statusLine, or one using ~, is left alone.
 for (const command of ['bash "' + copyPath + '"', 'bash ~/.claude/puritanical-statusline.sh']) {
   fs.writeFileSync(path.join(customConfigDir, 'settings.json'), JSON.stringify({ statusLine: { type: 'command', command } }));

tests/map.test.js

@@ -44,3 +44,17 @@
 assert.ok(map.includes('py/: default'), map);
 assert.ok(map.includes('self.helper'), map);
 fs.rmSync(dir, { recursive: true, force: true });
+
+// Indented Ruby and JVM declarations are found, and a file of blank lines (up to the
+// 64 KiB read cap) maps in linear time: the old leading \s* took seconds on one.
+const indented = fs.mkdtempSync(path.join(os.tmpdir(), 'puritanical-map-'));
+fs.writeFileSync(path.join(indented, 'a.rb'), 'module Outer\n  class Inner\n  end\nend\n');
+fs.writeFileSync(path.join(indented, 'A.java'), '\n  public static final class Widget {}\n');
+fs.writeFileSync(path.join(indented, 'blank.rb'), '\n'.repeat(65536));
+fs.writeFileSync(path.join(indented, 'Blank.java'), '\n'.repeat(65536));
+const started = Date.now();
+const indentedMap = buildMap(indented);
+const elapsed = Date.now() - started;
+assert.ok(indentedMap.includes('Inner') && indentedMap.includes('Widget'), indentedMap);
+assert.ok(elapsed < 1000, `buildMap took ${elapsed} ms on blank-line files`);
+fs.rmSync(indented, { recursive: true, force: true });