run tests on built test files, test on all supported nodes

A11yance / aria-query

Programmatic access to the ARIA specification

Apache License 2.0

275 stars 43 forks source link

run tests on built test files, test on all supported nodes #567

Closed ljharb closed 3 weeks ago

ljharb commented 2 months ago

This is effectively the same PR as https://github.com/A11yance/axobject-query/pull/356.

codesandbox-ci[bot] commented 2 months ago

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

wojtekmaj commented 2 months ago

This is a Trojan horse pull request. The PR title clearly states that the purpose is to "test built code". In reality, the PR:

Sneaks in support for Node 0.4 (I was only able to track down an intention to support Node 6: https://github.com/A11yance/aria-query/pull/162#discussion_r631745298)
Replaces fundamental GitHub Actions with ones you control
Changes the testing framework to one you control
Adds a bunch of new dev dependencies that you control

If you're making changes like this, at least be honest about it. There's nothing to be ashamed of, or is there?

AaronDewes commented 2 months ago

To be fair, the actions are pinned to a commit. There isn't a risk of malicious code being added there. The deps are more dsngerous though, but there is always some trust in maintainers involved.

yamiteru commented 2 months ago

LGTM

HawkeyePierce89 commented 2 months ago

I want to remind you that the previous Trojan pull request was accepted in the neighboring repository https://github.com/A11yance/axobject-query/pull/354

The more you allow someone, the more brazen they become

nitelite commented 2 months ago

Doesn't look good to me.

ljharb commented 2 months ago

These are all dev deps, and as such, it doesn’t make sense for anyone but maintainers to have an opinion on them.

@wojtekmaj there’s nothing dishonest here, and accusing me of doing something “sneaky” is an absurd accusation.