The fork's entire CI pipeline is two jobs, build and publish, and neither ever calls pnpm lint, pnpm test:unit, tsc, eslint, or knip. The "Smoke-check output" step only asserts embedded/web/dist/index.html and .../assets exist and prints du/ls to the job summary — it never boots the app or exercises any code path. A type error, a failing unit test, a lint violation, or a knip dead-code/unused-dependency regression anywhere in src/ (including all of src/lotus/*) can be pushed to lotus and tagged straight to a published npm release with zero CI signal. This is materially weaker than what LOTUS_TODO.md's own "CI/CD + per-feature checklist" describes as the intended hard-gate model (npm ci → build + npm test + tsc + eslint + prettier (ALL hard gates)) and weaker than cinny's own ci.yml, which this file's header comment explicitly says it "Models."
How to trigger
Push a commit to lotus that breaks pnpm test:unit or introduces a type error under src/lotus/, then push a vX.Y.Z-lotus.N tag — the build job's smoke-check still passes (dist exists) and publish proceeds to npm publish.
Suggested fix
Add a test (or extend build) step running pnpm lint and pnpm test:unit --run before the build/publish steps, and make publish depend on it (needs: [build, test]).
Filed from the September 2026 audit (branch lotus).
**Severity:** high · **Type:** bug · **Confidence:** high
**Location:** `.gitea/workflows/ci.yml:1-108` (whole file); compare `package.json:22` (`"lint": "pnpm lint:types && pnpm lint:eslint && pnpm lint:knip"`) and `package.json:31` (`"test:unit": "vitest --project=unit"`)
### Problem
The fork's entire CI pipeline is two jobs, `build` and `publish`, and neither ever calls `pnpm lint`, `pnpm test:unit`, `tsc`, `eslint`, or `knip`. The "Smoke-check output" step only asserts `embedded/web/dist/index.html` and `.../assets` exist and prints `du`/`ls` to the job summary — it never boots the app or exercises any code path. A type error, a failing unit test, a lint violation, or a `knip` dead-code/unused-dependency regression anywhere in `src/` (including all of `src/lotus/*`) can be pushed to `lotus` and tagged straight to a published npm release with zero CI signal. This is materially weaker than what LOTUS_TODO.md's own "CI/CD + per-feature checklist" describes as the intended hard-gate model (`npm ci → build + npm test + tsc + eslint + prettier (ALL hard gates)`) and weaker than cinny's own `ci.yml`, which this file's header comment explicitly says it "Models."
### How to trigger
Push a commit to `lotus` that breaks `pnpm test:unit` or introduces a type error under `src/lotus/`, then push a `vX.Y.Z-lotus.N` tag — the `build` job's smoke-check still passes (dist exists) and `publish` proceeds to `npm publish`.
### Suggested fix
Add a `test` (or extend `build`) step running `pnpm lint` and `pnpm test:unit --run` before the build/publish steps, and make `publish` depend on it (`needs: [build, test]`).
---
_Filed from the September 2026 audit (branch `lotus`)._
jared
added this to the EC fork audit 2026-09 · High milestone 2026-09-12 02:12:58 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: high · Type: bug · Confidence: high
Location:
.gitea/workflows/ci.yml:1-108(whole file); comparepackage.json:22("lint": "pnpm lint:types && pnpm lint:eslint && pnpm lint:knip") andpackage.json:31("test:unit": "vitest --project=unit")Problem
The fork's entire CI pipeline is two jobs,
buildandpublish, and neither ever callspnpm lint,pnpm test:unit,tsc,eslint, orknip. The "Smoke-check output" step only assertsembedded/web/dist/index.htmland.../assetsexist and printsdu/lsto the job summary — it never boots the app or exercises any code path. A type error, a failing unit test, a lint violation, or aknipdead-code/unused-dependency regression anywhere insrc/(including all ofsrc/lotus/*) can be pushed tolotusand tagged straight to a published npm release with zero CI signal. This is materially weaker than what LOTUS_TODO.md's own "CI/CD + per-feature checklist" describes as the intended hard-gate model (npm ci → build + npm test + tsc + eslint + prettier (ALL hard gates)) and weaker than cinny's ownci.yml, which this file's header comment explicitly says it "Models."How to trigger
Push a commit to
lotusthat breakspnpm test:unitor introduces a type error undersrc/lotus/, then push avX.Y.Z-lotus.Ntag — thebuildjob's smoke-check still passes (dist exists) andpublishproceeds tonpm publish.Suggested fix
Add a
test(or extendbuild) step runningpnpm lintandpnpm test:unit --runbefore the build/publish steps, and makepublishdepend on it (needs: [build, test]).Filed from the September 2026 audit (branch
lotus).Fixed in
9c521463, shipped in0.25.0-lotus.1(published by CI from tag v0.25.0-lotus.1) and consumed by cinny at 9a85a487.