Skip to content

Fix security linting error: non-literal require in size-checker tests#27

Merged
warengonzaga merged 10 commits intodevfrom
copilot/add-file-size-checker
Feb 12, 2026
Merged

Fix security linting error: non-literal require in size-checker tests#27
warengonzaga merged 10 commits intodevfrom
copilot/add-file-size-checker

Conversation

Copy link
Contributor

Copilot AI commented Feb 11, 2026

CI security linting was failing on security/detect-non-literal-require rule violation in test file.

Changes

src/tests/size-checker.test.ts

  • Replaced dynamic require() call with readFileSync() + JSON.parse()
  • Added readFileSync import from fs

Before/After

// Before - triggers security warning
const packageJson = require(join(projectRoot, 'package.json'));

// After - safe static file read
const packageJsonPath = join(projectRoot, 'package.json');
const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf8'));

The linting rule flags require() with computed paths as potential arbitrary file loading vectors. Using explicit file system operations avoids the warning while maintaining identical functionality.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • downloads.snyk.io
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node wrapper_dist/bootstrap.js exec (dns block)
  • o30291.ingest.sentry.io
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node wrapper_dist/bootstrap.js exec (dns block)
  • static.snyk.io
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node wrapper_dist/bootstrap.js exec (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Original prompt

This section details on the original issue you should resolve

<issue_title>Add file size checker to maintain its lightweight feature</issue_title>
<issue_description>It's okay to have size checker as part of the maintenance to check if the project exceeds the limit for being lightweight.</issue_description>

<agent_instructions>PR to dev branch</agent_instructions>

Comments on the Issue (you are @copilot in this section)


💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Copilot AI and others added 5 commits February 11, 2026 13:57
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Copilot AI changed the title [WIP] Add file size checker to maintain lightweight feature Add automated bundle size monitoring to maintain lightweight feature Feb 11, 2026
Copilot AI requested a review from warengonzaga February 11, 2026 14:06
@warengonzaga warengonzaga marked this pull request as ready for review February 11, 2026 14:19
@warengonzaga warengonzaga requested a review from Copilot February 11, 2026 14:19
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR implements automated bundle size monitoring to enforce the library's "lightweight" promise. It introduces a size validation script that checks the dist output against defined thresholds (1MB total, 512KB per format), integrates it into the CI/CD pipeline, and adds comprehensive test coverage.

Changes:

  • Added automated size checker script with configurable thresholds and formatted reporting
  • Integrated size checking into the validation pipeline and CI/CD workflows
  • Added comprehensive test suite validating script execution and size limits

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
scripts/check-size.js New script that recursively calculates directory sizes, validates against thresholds (1MB total, 512KB ESM/CJS), and provides formatted output with exit codes for CI integration
src/__tests__/size-checker.test.ts New test suite with 10 tests covering script existence, execution, output validation, size limit checks, and npm script integration
package.json Added size:check script and integrated it into the validate script chain
.github/workflows/size-check.yml New CI workflow that runs on push/PR to main/dev branches, building and validating bundle size with proper pnpm setup
README.md Added "Size Monitoring" feature documentation and updated available scripts section

@warengonzaga warengonzaga linked an issue Feb 11, 2026 that may be closed by this pull request
@warengonzaga
Copy link
Member

@copilot apply changes based on the comments in this thread

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Feb 11, 2026

@copilot apply changes based on the comments in this thread

Applied all changes from the review feedback in commit 8b82c3c:

  • Removed unused sizeKB variable in checkSize function
  • Combined duplicate dirname imports into a single import statement
  • Optimized test execution in "Size limits validation" by running the script once in beforeAll and reusing output across all three test cases

All tests pass and the script works correctly.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • api.example.com
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/log-engine/log-engine/node_modules/.bin/../jest/bin/jest.js --watchAll=false (dns block)
    • Triggering command: /opt/hostedtoolcache/node/24.13.0/x64/bin/node /opt/hostedtoolcache/node/24.13.0/x64/bin/node /home/REDACTED/work/log-engine/log-engine/node_modules/.pnpm/jest-worker@29.7.0/node_modules/jest-worker/build/workers/processChild.js (dns block)
  • downloads.snyk.io
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node wrapper_dist/bootstrap.js exec (dns block)
  • o30291.ingest.sentry.io
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node wrapper_dist/bootstrap.js exec (dns block)
  • static.snyk.io
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node wrapper_dist/bootstrap.js exec (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 8 comments.

@warengonzaga
Copy link
Member

@copilot apply changes based on the comments in this thread.

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Feb 12, 2026

@copilot apply changes based on the comments in this thread.

Applied all changes from the review feedback in commit a742641:

Error Handling & Validation:

  • Added explicit checks for missing dist/esm and dist/cjs directories with clear error messages
  • Improved getDirectorySize to only treat ENOENT as empty; surfaces other IO errors
  • Enhanced test build error handling with detailed stdout/stderr output

Type Safety:

  • Fixed encoding from 'utf-8' to 'utf8' in all execSync calls for proper TypeScript typing
  • Removed unsafe type casts (as unknown as string)

Documentation:

  • Updated CONTRIBUTING.md to reflect size check in validate script

All tests pass and the script now provides better error detection and reporting.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • api.example.com
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/log-engine/log-engine/node_modules/.bin/../jest/bin/jest.js --watchAll=false (dns block)
    • Triggering command: /opt/hostedtoolcache/node/24.13.0/x64/bin/node /opt/hostedtoolcache/node/24.13.0/x64/bin/node /home/REDACTED/work/log-engine/log-engine/node_modules/.pnpm/jest-worker@29.7.0/node_modules/jest-worker/build/workers/processChild.js (dns block)
  • downloads.snyk.io
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node wrapper_dist/bootstrap.js exec (dns block)
  • o30291.ingest.sentry.io
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node wrapper_dist/bootstrap.js exec (dns block)
  • static.snyk.io
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node wrapper_dist/bootstrap.js exec (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

@warengonzaga
Copy link
Member

@copilot apply changes based on the comments in this thread

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Feb 12, 2026

@copilot apply changes based on the comments in this thread

Applied all changes from the review feedback in commit d093805:

Security Fix:

  • Replaced execSync with execFileSync for node command execution to prevent shell injection vulnerabilities when repo path contains spaces or shell metacharacters
  • Only kept execSync for the pnpm command where it's necessary for shell processing

Error Visibility Fix:

  • Replaced console.error with process.stderr.write in build failure diagnostics
  • Ensures error output is visible during test runs since jest.setup.js mocks console.error

All tests pass and the code is now more secure and reliable.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • api.example.com
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/log-engine/log-engine/node_modules/.bin/../jest/bin/jest.js --watchAll=false (dns block)
    • Triggering command: /opt/hostedtoolcache/node/24.13.0/x64/bin/node /opt/hostedtoolcache/node/24.13.0/x64/bin/node /home/REDACTED/work/log-engine/log-engine/node_modules/.pnpm/jest-worker@29.7.0/node_modules/jest-worker/build/workers/processChild.js (dns block)
  • downloads.snyk.io
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node wrapper_dist/bootstrap.js exec (dns block)
  • o30291.ingest.sentry.io
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node wrapper_dist/bootstrap.js exec (dns block)
  • static.snyk.io
    • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node wrapper_dist/bootstrap.js exec (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

@codecov
Copy link

codecov bot commented Feb 12, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Copilot AI changed the title Add automated bundle size monitoring to maintain lightweight feature Fix security linting error: non-literal require in size-checker tests Feb 12, 2026
@warengonzaga warengonzaga merged commit 8103926 into dev Feb 12, 2026
9 checks passed
@warengonzaga warengonzaga deleted the copilot/add-file-size-checker branch February 12, 2026 03:35
warengonzaga added a commit that referenced this pull request Feb 12, 2026
* 📦 new: add bundle size checker with tests and workflow (#27)

* Initial plan

* 📦 new: add bundle size checker with tests and workflow

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 📖 docs: add bundle size checker to documentation

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🧪 test: fix inverted logic in size checker test

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔒 security: add permissions block to size-check workflow

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* ⚙️ setup: fix linting issues in size-checker test

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update: address PR review feedback

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update: improve error handling and validation

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔒 security: fix shell injection and improve error visibility

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔒 security: fix non-literal require in tests

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 📦 new (emoji): add emoji selector and context-aware logic (#26)

* Initial plan

* 📦 new (emoji): add emoji selector and context-aware logic

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 📖 docs: add comprehensive emoji feature documentation

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update: fix linting issues in emoji feature

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update (emoji): address code review feedback

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update: enable emoji by default and move toggle to format.includeEmoji

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 📖 docs: update README for new emoji configuration pattern

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update: fix trailing spaces in tests

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update (emoji): address code review feedback on performance and state management

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update (emoji): move config to Logger.configure() to preserve regex cache

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update: fix eslint errors by removing invalid security rule comments

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔒 security: add eslint-disable comments for safe code patterns

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* � test: improve patch coverage for emoji feature

- Remove deprecated dead-code methods (getMappings, matchesKeywords) from EmojiSelector
- Add tests for unknown log level edge case in EmojiSelector
- Add tests for Logger.configure emoji configuration path
- Add tests for numeric and boolean data edge cases

* 🧪 test: improve patch coverage for emoji feature

- Remove deprecated dead-code methods (getMappings, matchesKeywords) from EmojiSelector
- Add tests for unknown log level edge case in EmojiSelector
- Add tests for Logger.configure emoji configuration path
- Add tests for numeric and boolean data edge cases

* 🗑️ remove: delete outdated Snyk security instructions

* 🔧 update: address code review feedback on performance and safety

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Co-authored-by: Waren Gonzaga <opensource@warengonzaga.com>

* 🚀 release: bump version to 2.3.0

* 🗑️ remove: delete repository banner image

* 📖 docs: update README with new features and improved descriptions

* 📖 docs: update README to format code blocks for emoji log examples

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
warengonzaga added a commit that referenced this pull request Feb 14, 2026
* 📦 new: add bundle size checker with tests and workflow (#27)

* Initial plan

* 📦 new: add bundle size checker with tests and workflow

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 📖 docs: add bundle size checker to documentation

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🧪 test: fix inverted logic in size checker test

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔒 security: add permissions block to size-check workflow

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* ⚙️ setup: fix linting issues in size-checker test

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update: address PR review feedback

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update: improve error handling and validation

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔒 security: fix shell injection and improve error visibility

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔒 security: fix non-literal require in tests

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 📦 new (emoji): add emoji selector and context-aware logic (#26)

* Initial plan

* 📦 new (emoji): add emoji selector and context-aware logic

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 📖 docs: add comprehensive emoji feature documentation

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update: fix linting issues in emoji feature

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update (emoji): address code review feedback

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update: enable emoji by default and move toggle to format.includeEmoji

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 📖 docs: update README for new emoji configuration pattern

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update: fix trailing spaces in tests

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update (emoji): address code review feedback on performance and state management

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update (emoji): move config to Logger.configure() to preserve regex cache

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update: fix eslint errors by removing invalid security rule comments

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔒 security: add eslint-disable comments for safe code patterns

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* � test: improve patch coverage for emoji feature

- Remove deprecated dead-code methods (getMappings, matchesKeywords) from EmojiSelector
- Add tests for unknown log level edge case in EmojiSelector
- Add tests for Logger.configure emoji configuration path
- Add tests for numeric and boolean data edge cases

* 🧪 test: improve patch coverage for emoji feature

- Remove deprecated dead-code methods (getMappings, matchesKeywords) from EmojiSelector
- Add tests for unknown log level edge case in EmojiSelector
- Add tests for Logger.configure emoji configuration path
- Add tests for numeric and boolean data edge cases

* 🗑️ remove: delete outdated Snyk security instructions

* 🔧 update: address code review feedback on performance and safety

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Co-authored-by: Waren Gonzaga <opensource@warengonzaga.com>

* 🚀 release: bump version to 2.3.0

* 🗑️ remove: delete repository banner image

* 📖 docs: update README with new features and improved descriptions

* 📖 docs: update README to format code blocks for emoji log examples

* 🔧 update: add LogCallOptions interface and update signatures (#31)

* Initial plan

* 🔧 update: add LogCallOptions interface and update signatures

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🧪 test: add comprehensive tests for emoji override

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update: add options parameter to LogEngine wrapper

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update: address code review feedback

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 📖 docs: enhance LogCallOptions JSDoc and add LogEngine wrapper tests

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🔧 update: replace magic numbers with LogMode enum constants

Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>

* 🚀 release: bump version to 2.3.1

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: warengonzaga <15052701+warengonzaga@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add file size checker to maintain its lightweight feature

3 participants