ForgeFlow/docs/TEST_MATRIX.md

Test matrix

Automated in v0.4.0

The suite contains 59 passing tests.

Git and repository behavior

• porcelain v2 ordinary and rename parsing;
• HTTPS and SCP-style remote matching;
• real temporary bare remote: status, diff, selected commit and push;
• real temporary bare remote: commit-only, branch creation/publication and remote-SHA ancestry verification;
• real stash creation, listing, pop and untracked-file restoration;
• repository monitor baseline, change detection and pause/resume;
• safe repository folder-name derivation from HTTPS and SSH clone URLs;
• automatic target construction beneath the project root;
• missing, empty and matching-checkout clone target handling;
• different repository, ordinary non-empty folder and file conflict rejection.

Gitea and deployment behavior

• Gitea URL/credential validation;
• Actions run normalization across payload shapes;
• optional query-filter compatibility retry;
• runs-to-tasks fallback;
• newest matching run selection;
• repository workflow contents lookup and 404 behavior;
• deployment terminal-status mapping;
• controlled dispatch inputs that cannot be overridden by profile data;
• exact post-workflow SHA and request-ID verification;
• rollback input allowlisting and exact current previous-SHA enforcement;
• complete deployment preflight with Git, workflow, Actions, status and health mocks.

Security and diagnostics

• repository path traversal and absolute-path rejection;
• workflow filename, branch, environment and full-SHA validation;
• clone protocol and embedded-password rejection;
• runtime token, authorization, query token, URL credential and private-key redaction;
• camelCase and nested sensitive-key removal;
• home-path aliasing;
• deterministic strict-privacy identifier hashing;
• required versus optional preflight blocking behavior;
• system preflight before credentials are entered;
• structured JSONL diagnostic writes;
• support-bundle strict privacy and secret exclusion;
• ZIP structure, deflate payloads and CRC validation.
• Windows npm command-shim discovery through npm_execpath and cmd.exe;
• normal direct npm discovery on non-Windows systems.

Static source quality gate

npm run verify checks:

• all required source, documentation and server-template files;
• JavaScript syntax across the project;
• package version and required scripts;
• desktop packaging metadata and icons;
• Bash syntax for the server entry point;
• status JSON parsing;
• required setup-guide sections;
• renderer entry hooks.

Manual before a real production release

• setup wizard against the installed Gitea version;
• repository discovery on the target Windows system;
• token persistence through Windows credential protection;
• HTTPS and/or SSH Git authentication;
• actual Actions dispatch, run resolution and job visibility;
• runner label and repository trust scope;
• server target-file ownership/mode enforcement;
• status endpoint through the real reverse proxy;
• deployment lock, failed healthcheck and rollback;
• diagnostic ZIP inspection after a deliberately failed deployment;
• unsigned installer and portable build on Windows;
• keyboard-only and screen-reader smoke test.

Renderer smoke target

The standalone demo should be checked at minimum at:

• 1120 × 720;
• 1440 × 900;
• 1920 × 1080.

Required views now include setup readiness, dashboard, repository workspace, deployment preflight, active run, success/failure and Diagnostics.

v0.4 additions

• bounded independently scrollable changed-file layout;
• explicit commit-message and selection readiness contract;
• ITWorx.tech asset integration;
• semantic update-version comparison;
• exact-SHA Gitea update manifest lookup;
• update repository path-injection rejection;
• SSH host-key fingerprint helper;
• remote shell quoting;
• Unraid folder and Compose path escape rejection;
• server inspection payload decoding;
• SSH deployment preflight summary behavior.