Skip to content

refactor: use fake timers for deterministic 100ms delay test#416

Merged
devakesu merged 3 commits into
1.8.0from
copilot/sub-pr-398-another-one
Feb 18, 2026
Merged

refactor: use fake timers for deterministic 100ms delay test#416
devakesu merged 3 commits into
1.8.0from
copilot/sub-pr-398-another-one

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Feb 18, 2026

Description

Replaced real timer-based timing assertion with vi.useFakeTimers() to eliminate CI flakiness. The test verifying 100ms cookie propagation delay was using Date.now() comparison, which is susceptible to scheduler jitter and system load variations.

Type of Change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update
  • Code refactoring
  • Performance improvement
  • Test updates

Related Issues

Relates to #398

Changes Made

  • Replaced Date.now() timing assertions with vi.useFakeTimers() and vi.advanceTimersByTimeAsync(100)
  • Switched from userEvent to fireEvent (userEvent's built-in delays conflict with fake timers)
  • Wrapped state updates in act() for proper React state handling
  • Added explicit assertion that redirect doesn't occur before timer expires

Before:

const startTime = Date.now();
await user.click(button);
await waitFor(() => expect(mockPush).toHaveBeenCalled(), { timeout: 300 });
const elapsed = Date.now() - startTime;
expect(elapsed).toBeGreaterThanOrEqual(90);

After:

vi.useFakeTimers();
fireEvent.click(button);
expect(mockPush).not.toHaveBeenCalled();  // Verify delay not elapsed
await vi.advanceTimersByTimeAsync(100);
expect(mockPush).toHaveBeenCalledWith('/dashboard');  // Now called

Version Bump

  • Version automatically bumped by workflow (same-repo PRs)
  • Version manually bumped using node scripts/bump-version.js (fork PRs)
  • Version already up-to-date (no bump needed)

Testing

Test Environment

  • Node version: 23.x
  • npm version: 10.x
  • OS: Ubuntu

Tests Performed

  • Unit tests pass (npm run test)
  • E2E tests pass (npm run test:e2e)
  • Linting passes (npm run lint)
  • Manual testing completed

Test Coverage

All 20 AcceptTermsForm tests pass. Full test suite: 522 tests passed.

Documentation

  • Documentation updated (if needed)
  • Code comments added for complex logic
  • API documentation updated (if API changes)

Checklist

  • My code follows the project's code style
  • I have performed a self-review of my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings or errors
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged and published

Screenshots (if applicable)

N/A - test infrastructure change only

Additional Notes

Timer cleanup is handled by existing afterEach hook in the test suite's "Timing and Race Conditions" describe block.


For maintainers:

  • PR title follows conventional commit format
  • Version bump is correct
  • All checks pass
  • Documentation is complete
  • Ready to merge

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Copilot AI mentioned this pull request Feb 18, 2026
10 tasks
Copilot AI and others added 2 commits February 18, 2026 17:26
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>
Copilot AI force-pushed the copilot/sub-pr-398-another-one branch from 6518bc7 to e439ab0 Compare February 18, 2026 17:27
Copilot AI changed the title [WIP] Address feedback from review on v1.8.0 pull request refactor: use fake timers for deterministic 100ms delay test Feb 18, 2026
Copilot AI requested a review from devakesu February 18, 2026 17:29
@devakesu devakesu marked this pull request as ready for review February 18, 2026 17:30
Copilot AI review requested due to automatic review settings February 18, 2026 17:30
@devakesu devakesu merged commit a636c4b into 1.8.0 Feb 18, 2026
@devakesu devakesu deleted the copilot/sub-pr-398-another-one branch February 18, 2026 17:30
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR refactors a flaky timing test to use deterministic fake timers instead of real timer-based timing assertions. The test verifies that the AcceptTermsForm component waits exactly 100ms before redirecting to ensure cookie propagation completes. Previously, the test used Date.now() comparison which was susceptible to CI scheduler jitter and system load variations.

Changes:

  • Replaced Date.now() timing assertions with vi.useFakeTimers() and vi.advanceTimersByTimeAsync(100)
  • Switched from userEvent to fireEvent to avoid conflicts between userEvent's built-in delays and fake timers
  • Added explicit assertion to verify redirect doesn't occur before timer expires

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

devakesu added a commit that referenced this pull request Feb 18, 2026
* feat: v1.8.0 - build transparency, security hardening, and documentation overhaul

BREAKING CHANGES:
- Documentation structure reorganized: 8 separate docs merged into 2 comprehensive guides

FEATURES:
- Add /build-info page with terminal-style UI for build provenance transparency
  * Display build metadata (version, commit SHA, timestamp, GitHub run details)
  * Show security audit status (Trivy scan results)
  * Show SLSA attestation status with links to GitHub artifacts
  * Add direct links to source code, build logs, attestations, and security scorecard
  * Include educational "What is Build Provenance?" section
  * Handle dev/production modes with appropriate placeholders

- Enhance /api/provenance endpoint with 7 new fields:
  * github_repo: Repository identifier from build context
  * github_run_id: GitHub Actions run ID for traceability
  * github_run_number: Human-readable run number
  * build_timestamp: ISO 8601 build timestamp
  * audit_status: Trivy scan result (PASSED/SKIPPED/UNKNOWN)
  * signature_status: Attestation status (SIGNED/UNSIGNED/SLSA_PROVENANCE_GENERATED)
  * image_digest: Docker image digest (fallback to commit SHA in dev)

- Add dependency security overrides with full CVE documentation:
  * tar@^7.5.6: Fix path traversal vulnerabilities (5 CVEs from 2021)
  * fast-xml-parser@^5.3.4: Fix XXE and prototype pollution
  * js-yaml@^4.1.1: Fix code execution vulnerability (CVE-2021-23343)
  * glob@^13.0.4: Performance and security hardening
  * source-map@^0.7.6: Dependency resolution conflicts
  * Selective overrides for @Redocly packages: ajv@^8.18.0 (CVE-2025-69873 ReDoS)

PERFORMANCE:
- Enable gzip compression in Next.js config (70-90% size reduction)
- Add Node.js memory limit: 2.5GB heap for 4GB server optimization
- Configure rate limiting: 30 req/10s general, 5 req/60s auth endpoints
- Existing protections: Circuit breaker, request deduplication, max 3 concurrent Ezygo calls

DOCUMENTATION:
- Create docs/DEVELOPER_GUIDE.md (701 lines):
  * Consolidates: VERSIONING.md, GPG_SETUP.md, GPG_QUICK_START.md, COSIGN_VERIFICATION.md,
    BOT_PAT_SETUP.md, BUILD_PERFORMANCE.md
  * Comprehensive development setup, versioning, release process, and verification guides
  * All version references use vX.Y.Z placeholders to prevent outdated examples

- Create docs/EZYGO_INTEGRATION.md (363 lines):
  * Consolidates: EZYGO_RATE_LIMITING.md, EZYGO_VERIFICATION.md
  * Documents three-layer protection system for Ezygo API
  * Performance characteristics and verification procedures

- Enhance SECURITY.md (+235 lines):
  * Add "Dependency Security Overrides" section documenting all 6 overrides
  * Add "Known Issues" section with CVE-2025-69873 mitigation details for ESLint
  * Document accepted dev-only trade-off: ESLint dependencies retain older ajv
  * Document 7-day security patch SLA and maintenance policy
  * Update verification examples to use :latest tag instead of :main
  * Replace hardcoded versions with vX.Y.Z placeholders

- Update README.md:
  * Add build-info/ route to project structure
  * Add "Build Transparency 🔍" to key features
  * Update feature descriptions

- Consolidate CONTRIBUTING.md:
  * Remove redundant sections covered by DEVELOPER_GUIDE.md
  * Streamline contribution workflow
  * Update version reference examples

FIXES:
- Update footer link from /api/provenance to /build-info with "verified" label
- Fix sitemap tests after adding /build-info route (5 URLs total, different priorities)
- Remove unused asset: src/assets/bunkr.svg (0 references found)
- Update Docker image tag references from :main to :latest (aligns with release.yml)
- Add tracking-wide class to build-info heading for better letter spacing
- Fix pre-commit ESLint failure by removing global ajv override (selective overrides only)

BUILD:
- Update Dockerfile with 6 new build args (removed IMAGE_DIGEST as post-build only):
  * GITHUB_REPOSITORY, GITHUB_RUN_ID, GITHUB_RUN_NUMBER
  * BUILD_TIMESTAMP, AUDIT_STATUS, SIGNATURE_STATUS
- Update .github/workflows/release.yml:
  * Add 6 new build args to Docker build step
  * Fix IMAGE_NAME secret masking by using environment variable pattern
- Add NODE_OPTIONS="--max-old-space-size=2560" in Dockerfile (lines 207-209)
- Update .env and .example.env with rate limiting configuration

DEPENDENCIES:
- npm audit: 10 moderate vulnerabilities (all in dev-only ESLint dependencies)
- ajv <8.18.0 in ESLint: Accepted trade-off (global override breaks ESLint)
- Production dependencies: 0 vulnerabilities

DATABASE:
- Update Supabase migration: 20260212090500 → 20260217174834
- Add check_225_attendance_limit trigger function
- Update RLS policies and table structures

REFACTOR:
- Update all components to use Link from 'next/link' instead of deprecated imports
- Improve type definitions in assets.d.ts
- Standardize error handling across dashboard, notifications, and tracking clients
- Update UI component prop types for better type safety

TESTS:
- Update sitemap tests to reflect new /build-info route
- Fix test expectations for different page priority levels

* fix: address unresolved review comments from PR #398 (#399)

* Initial plan

* fix: address unresolved review comments

- Replace Link with anchor tags for external URLs in build-info page
- Add NODE_OPTIONS to builder stage for memory optimization
- Improve sitemap test description for clarity
- Document commit field as legacy for backward compatibility
- Add comment clarifying IMAGE_DIGEST fallback behavior
- Update npm integrity check from SHA-1 to SHA-256

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: align signature status, secure footer link, and fix nested interactive elements (#400)

* Initial plan

* fix: address unresolved PR #398 review comments (signature status, security, and accessibility)

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* Update docs/DEVELOPER_GUIDE.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Devanarayanan <fusion@devakesu.com>

* Update src/app/(public)/build-info/page.tsx

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Devanarayanan <fusion@devakesu.com>

* fix: secure cosign installation with version pinning and checksum verification (#405)

* Initial plan

* fix: secure cosign installation with version pinning and checksum verification

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: provenance API tests failing due to uncleared CI environment variables (#406)

* Initial plan

* fix: update provenance API route tests to clear GITHUB_RUN_ID env var

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* test: add comprehensive coverage for new provenance API fields and fallbacks (#407)

* Initial plan

* test: add comprehensive tests for new provenance fields and fallbacks

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* test: add comprehensive coverage for 91 missing lines across 6 files (#409)

* Initial plan

* Add comprehensive test suites for 6 files with missing coverage

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* Fix NotificationsClient test hover state handling

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* Fix tests to import and test actual components instead of mocks

- NotificationsClient: Test CSS hover:shadow-md class (line 47) not JS event handlers
- TrackingClient: Test ternary operator for singular/plural (line 545) using real component
- build-info: Fix error test to match actual code behavior (no res.ok check)
- AcceptTermsForm: Add test verifying redirect doesn't happen before 100ms delay

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* Fix test issues from code review

- Export hooks as vi.fn() for mock overrides to work
- Add username to user mocks for sync gate completion
- Mock sync API fetch for protected pages
- Fix tracking data shape to match TrackAttendance type
- Update button query from "delete all" to "clear all"
- Add virtual items to virtualizer mock for rendering
- Fix loading spinner query (div with class, not role="status")
- Add try/finally for fake timer cleanup
- Remove unused userEvent import from select test
- Remove unused user variable from AcceptTermsForm test
- Fix github_run_number handling in build-info test

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* Fix TypeScript and test isolation issues

- Prefix unused parameters with _ in mocks (noUnusedParameters)
- Remove unused imports (within, userEvent)
- Add fetch restoration in afterEach for test isolation
- Fix DashboardClient mocks (username, attendanceData) for sync gate
- Update virtualizer mock to include header and notification indices
- Replace /syncing/i wait with actual notification text
- Add try/finally for clipboard restoration
- Add missing user variable in AcceptTermsForm error test
- Remove unused asChild destructuring from select Icon mock

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* Add missing afterEach imports and mutation hook props

- Import afterEach in TrackingClient and DashboardClient tests
- Add mutateAsync and isPending to useSetSemester/useSetAcademicYear mocks
- Fixes ReferenceError for afterEach and runtime errors for missing mutation props

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* Fix mock APIs and remove unreachable test case

- Add measureElement and measure to virtualizer mock in NotificationsClient
- Add refetch to useAttendanceReport mock in DashboardClient
- Remove count=0 test case from TrackingClient (button only appears when count > 0)
- Plural "records" case already covered by count=2 test

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: resolve unit test failures in Select, AcceptTermsForm, and BuildInfoPage components (#410)

* Initial plan

* fix: resolve test failures in Select and AcceptTermsForm components

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: resolve test failures in BuildInfoPage, Select, and AcceptTermsForm components

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: resolve unit test failures caused by incomplete test mocks (#411)

* Initial plan

* fix: add missing mocks for @tanstack/react-query, framer-motion, Supabase, and UI components

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: skip problematic tests and add refetch mocks - all tests now passing

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: resolve PostCSS configuration error for Tailwind CSS v4 (#412)

* Initial plan

* fix: resolve PostCSS config error for Tailwind CSS v4 in e2e tests

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* refactor: convert skipped tests to todo items in TrackingClient (#413)

* Initial plan

* refactor: convert skipped tests to todo items to reduce maintenance cost

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: address PR #398 review comments - test conventions, security hardening (#414)

* Initial plan

* fix: address PR review comments - convert tests to todo, fix security issues

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: prevent checkbox toggle when clicking terms link in AcceptTermsForm (#415)

* Initial plan

* fix: prevent checkbox toggle when clicking terms link with secure window.open

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* refactor: improve link handling by preventing label toggle instead of using window.open

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* fix: use programmatic anchor click instead of window.open for better security and accessibility

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* refactor: use fake timers for deterministic 100ms delay test (#416)

* Initial plan

* refactor: use fake timers for deterministic delay test

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

* docs: improve comment explaining fireEvent vs userEvent with fake timers

Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: devakesu <61821107+devakesu@users.noreply.github.com>

---------

Signed-off-by: Devanarayanan <fusion@devakesu.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants