[prx-my]

What changed and why

Jest transpiles tests without type-checking them, so a test can assert a shape the compiler would reject and stay green. tsconfig.test.json also sets isolatedModules, but the missing gate is the point: no workflow ran the compiler over the test tree.

Decision: gate new and changed files first, rather than fixing the whole backlog in this PR. The full test tree currently reports 261 errors, concentrated in a handful of files (scanner-cache 83, parent-upgrade 33, scanner-npm-advisory 31). Fixing them all here would turn the gate review into a large, risky refactor; gating changed files stops new debt immediately.

How it works

• scripts/typecheck-changed-tests.mjs <base-ref> lists the tests/**/*.ts files the branch added or modified with git diff -z, so spaces, Unicode and newlines survive.
• It drives TypeScript through the compiler API, gives it the changed files as roots, and matches diagnostics on resolved absolute paths.
• Diagnostics attached to unchanged files are counted but do not fail the PR. Configuration errors, diagnostics with no file, and compiler exceptions always fail.
• The build job runs it on pull_request events. The base commit is fetched shallowly by SHA, so it works for fork PRs too.
• CONTRIBUTING.md documents the local command.

Verification

• tests/scripts/typecheck-changed-tests.test.ts runs the real script against throwaway git repositories and covers: a normal type error, a Unicode filename, a filename with spaces plus errors in an imported unchanged file, a valid changed file with unchanged-file debt, no changed tests, and an unparseable TypeScript config.
• actionlint clean; npm run build and npm run lint:tests pass.
• CI probe completed: a committed type error in a changed test made build fail at Type-check changed tests with TS2322 (https://github.com/OWASP/cve-lite-cli/actions/runs/39554341092), while the suite itself still passed. The probe was reverted.
• The gate now type-checks the new regression test file itself on this PR: Type-checked 1 changed test file(s): no errors.

Part of #1364 - the gate is in place; the remaining pre-existing errors are backlog work.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[prx-my]

CI probe, as promised:

• Pushed a commit adding const probe: number = "not a number"; to tests/jest-smoke.test.ts. The suite still passes (ts-jest ignores types under isolatedModules), but build failed at Type-check changed tests: https://github.com/OWASP/cve-lite-cli/actions/runs/39554341092
• The log names the file and diagnostic: tests/jest-smoke.test.ts(14,7): error TS2322.
• Reverted the probe; the current run is green: https://github.com/OWASP/cve-lite-cli/actions/runs/39554443136

So the gate catches exactly the failure mode the issue describes, and a changed test cannot ship untyped.

[prx-my]

Review points addressed:

• Safe filenames: git diff -z, split on NUL, no trim(). Paths with spaces, Unicode, or newlines survive.
• Structured diagnostics: replaced the output regex with the TypeScript compiler API. Diagnostics are matched on resolved absolute paths against the changed set.
• Global failures: configuration errors, diagnostics with no file, and compiler exceptions now fail the gate. Only diagnostics explicitly attached to unchanged files are ignored.
• Regression tests: tests/scripts/typecheck-changed-tests.test.ts covers normal errors, Unicode names, spaces with unchanged imported errors, passing with unchanged-file debt, and the no-changes skip. Each test runs the real script against a throwaway git repo.

CI is green, and the gate type-checked the new test file on this PR (Type-checked 1 changed test file(s): no errors). Still Part of #1364; the backlog remains open.

[prx-my]

Cleanup applied: shorter header with the corrected Jest/type-checking explanation, unused ok/exports/import guard removed, noEmitOnError dropped, messages now say "errors in unchanged files" and "Test type-check failed", plus a sixth regression test for an unparseable tsconfig.test.json. PR description updated; CI is green and the gate type-checked the new test file.

[Copilot]

🟢 Approval recommended

The scoped gate, CI integration, documentation, and regression tests have no identified blocking issues.

No open issues 🎉

_{Review effort: Balanced}

[sonukapoor]

Approving this. The gap it closes is real and the shape of the fix is right.

Jest transpiles the test files without type-checking them, so a type error in a test never surfaces: the suite goes green and nothing tells you. On current main there are 264 such errors across 51 test files. That is not a backlog this pull request has to clear, and it correctly does not try.

What makes it workable is that it only looks at the test files a pull request actually changes, so those 264 stay where they are and only new ones block. I planted a type error in a test file and the gate exits 1 while the suite on that same file passes, which is exactly the behaviour that could not happen before.

Two things I liked that you were not asked for. The workflow passes the base commit through the environment and quotes it rather than interpolating it into the shell, which is the same pattern we had to retrofit onto the release workflow last week. And there are no casts, no any and no suppression comments anywhere in it, which would have been the easy way to make a type-check gate go green.

Merge result is clean against current main at 178 suites and 2,470 tests. Replacing the failing exit with a successful one fails 4 of your 6 tests, so the coverage discriminates.

One number for the record: your body says 261 pre-existing errors and I measure 264 today. That is main moving under you rather than a miscount, and it is an argument for the gate rather than against it.