Code Quality: PR #378 #1036
codeql
on: dynamic
Matrix: analyze
Annotations
3 warnings
|
Test uses vi.spyOn on imported module instead of injected dependency:
src/mcp/tools/device/__tests__/build_device.test.ts#L314
This new test relies on `vi.spyOn(buildUtils, 'executeXcodeBuildCommand')` to simulate an unexpected throw, rather than injecting a fake executor or dependency through the function signature. The skill's guardrails state that unit tests should inject command/filesystem/external dependencies and prefer testing logic via injected dependencies. Spying on a module-level import couples the test to the module's internal structure and bypasses the dependency-injection pattern used elsewhere in this file (which threads `mockExecutor` into `buildDeviceLogic`). Consider exposing `executeXcodeBuildCommand` as an injectable parameter so the throw can be simulated without module spying.
|
|
Analyze (python)
Starting April 2026, the CodeQL Action will skip computing file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses.
To opt out of this change, create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository's settings.
|
|
Analyze (javascript-typescript)
Starting April 2026, the CodeQL Action will skip computing file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses.
To opt out of this change, create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository's settings.
|