NO-JIRA: feat: migrate to vitest - #1237

#!/usr/bin/env bash
set -euo pipefail

python3 - <<'PY'
import json
from pathlib import Path
from urllib.request import Request, urlopen

names = ["`@vitest/coverage-v8`", "esbuild", "jsdom", "vite", "vitest"]
manifest = json.loads(Path("web/package.json").read_text())
lockfile = json.loads(Path("web/package-lock.json").read_text())

for name in names:
    version = manifest["devDependencies"][name]
    entry = lockfile["packages"].get(f"node_modules/{name}")
    assert entry and entry["version"] == version, (name, version, entry)
    assert entry.get("integrity"), f"missing integrity for {name}"
    metadata = json.load(urlopen(f"https://registry.npmjs.org/{name}/{version}"))
    print(name, version, metadata.get("license"))

    request = Request(
        "https://api.osv.dev/v1/query",
        data=json.dumps({
            "package": {"ecosystem": "npm", "name": name},
            "version": version,
        }).encode(),
        headers={"Content-Type": "application/json"},
    )
    vulnerabilities = json.load(urlopen(request)).get("vulns", [])
    assert not vulnerabilities, (name, vulnerabilities)
PY

fd -t f | xargs -r rg -n -i \
  'sbom|slsa|provenance|attest|cosign|sigstore' || true

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- tracked dependency and workflow files ---'
git ls-files 'web/package.json' 'web/package-lock.json' '.github/workflows/*' '.tekton/*' 'Dockerfile*' 'Makefile*' 'build*' | sed -n '1,160p'

printf '%s\n' '--- web/package.json ---'
sed -n '1,180p' web/package.json

printf '%s\n' '--- lockfile entries ---'
python3 - <<'PY'
import json
from pathlib import Path

manifest = json.loads(Path("web/package.json").read_text())
lockfile = json.loads(Path("web/package-lock.json").read_text())

for name in {"`@vitest/coverage-v8`", "esbuild", "jsdom", "vite", "vitest"}:
    version = manifest.get("devDependencies", {}).get(name)
    print(f"{name}: manifest={version}")
    print(json.dumps(
        lockfile.get("packages", {}).get(f"node_modules/{name}"),
        indent=2,
        sort_keys=True,
    ))
PY

printf '%s\n' '--- supply-chain references ---'
rg -n -i --glob '!web/package-lock.json' \
  'sbom|slsa|provenance|attest|cosign|sigstore|dependabot|osv|vulnerabil|integrity|npm audit' \
  .github .tekton Dockerfile* Makefile* build* web 2>/dev/null || true

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- lockfile integrity coverage ---'
python3 - <<'PY'
import json
from pathlib import Path

lock = json.loads(Path("web/package-lock.json").read_text())
packages = lock.get("packages", {})
missing = []
resolved = 0

for path, entry in packages.items():
    if not isinstance(entry, dict) or not entry.get("resolved"):
        continue
    resolved += 1
    if not entry.get("integrity"):
        missing.append((path, entry.get("version"), entry.get("resolved")))

print(f"resolved entries: {resolved}")
print(f"entries missing integrity: {len(missing)}")
for item in missing[:40]:
    print(item)

print('lockfile root:')
print(json.dumps({k: lock.get(k) for k in ("lockfileVersion", "requires")}, indent=2))
PY

printf '%s\n' '--- build and release configuration ---'
for file in Makefile Dockerfile Dockerfile.art Dockerfile.art-coo Dockerfile.dev Dockerfile.dev-mcp Dockerfile.devspace Dockerfile.mcp Dockerfile.test; do
  if [ -f "$file" ]; then
    printf '\n### %s\n' "$file"
    rg -n -i 'npm|node|build|push|image|sbom|slsa|provenance|attest|cosign|sigstore|sign' "$file" || true
  fi
done

printf '%s\n' '--- tracked CI and supply-chain files ---'
git ls-files | rg '(^|/)(\.github/workflows/|\.tekton/|dependabot|renovate|.*sbom.*|.*provenance.*|.*cosign.*|.*sigstore.*)' || true

printf '%s\n' '--- OSV results for the five pinned packages ---'
python3 - <<'PY'
import json
import subprocess

packages = [
    ("`@vitest/coverage-v8`", "4.1.11"),
    ("esbuild", "0.28.2"),
    ("jsdom", "29.1.1"),
    ("vite", "8.2.2"),
    ("vitest", "4.1.11"),
]

for name, version in packages:
    payload = json.dumps({
        "package": {"ecosystem": "npm", "name": name},
        "version": version,
    })
    result = subprocess.run(
        ["curl", "-fsSL", "--retry", "2", "-X", "POST",
         "https://api.osv.dev/v1/query",
         "-H", "Content-Type: application/json",
         "--data-binary", payload],
        capture_output=True,
        text=True,
    )
    if result.returncode:
        print(f"{name}@{version}: query failed: {result.stderr.strip()}")
        continue
    data = json.loads(result.stdout)
    print(f"{name}@{version}: {len(data.get('vulns', []))} vulnerabilities")
    for vuln in data.get("vulns", []):
        print(f"  {vuln.get('id')}: {vuln.get('summary', '')}")
PY

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- image build script ---'
sed -n '1,240p' scripts/build-image.sh

printf '%s\n' '--- related tracked scripts and configuration ---'
git ls-files scripts renovate.json | sed -n '1,160p'
rg -n -i \
  'sbom|slsa|provenance|attest|cosign|sigstore|sign|push|podman|buildah|docker' \
  scripts renovate.json Makefile Dockerfile* 2>/dev/null || true