Skip to content

Code Quality: PR #378 #1036

Code Quality: PR #378

Code Quality: PR #378 #1036

Triggered via dynamic April 28, 2026 21:48
Status Success
Total duration 1m 21s
Artifacts

codeql

on: dynamic
Matrix: analyze
Fit to window
Zoom out
Zoom in

Annotations

3 warnings
Test uses vi.spyOn on imported module instead of injected dependency: src/mcp/tools/device/__tests__/build_device.test.ts#L314
This new test relies on `vi.spyOn(buildUtils, 'executeXcodeBuildCommand')` to simulate an unexpected throw, rather than injecting a fake executor or dependency through the function signature. The skill's guardrails state that unit tests should inject command/filesystem/external dependencies and prefer testing logic via injected dependencies. Spying on a module-level import couples the test to the module's internal structure and bypasses the dependency-injection pattern used elsewhere in this file (which threads `mockExecutor` into `buildDeviceLogic`). Consider exposing `executeXcodeBuildCommand` as an injectable parameter so the throw can be simulated without module spying.
Analyze (python)
Starting April 2026, the CodeQL Action will skip computing file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. To opt out of this change, create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository's settings.
Analyze (javascript-typescript)
Starting April 2026, the CodeQL Action will skip computing file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. To opt out of this change, create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository's settings.