[DJRHails]

What

Follow-up from the review of #187 (already merged). tests/release-age.test.sh claimed its sandbox let only the stub npm/pnpm answer, but run_setup put /usr/bin:/bin on PATH. On a host with a system npm in /usr/bin (NodeSource, or Debian's npm package), the real npm answered the no-npm case: setup reported "npm 10.9.9 predates min-release-age" instead of "npm not installed", so the suite exited 1. The suite runs as an unconditional lefthook pre-commit hook (release-age-tests, no glob), so on such a host every commit to this repo was blocked. The bug dates from f7a6cc7 (#185).

The sandbox now gets a symlinked copy of /usr/bin and /bin with npm, npx, pnpm, pnpx and corepack left out, which makes the comment's guarantee true.

Verification

• On a host with /usr/bin/npm (10.9.9) and /usr/bin/pnpm: before the change, bash tests/release-age.test.sh gave 1 failed (no-npm-message). After it, all 54 checks pass.
• shellcheck is clean, shfmt -i 2 -d shows no diff, and the lefthook pre-commit suite passed on commit.

via gantry

[DJRHails]

Review Summary

No P1–P3 findings. The PR makes the test file's comment true: run_setup's PATH is now the stubs plus a symlink copy of /usr/bin and /bin without npm/npx/pnpm/pnpx/corepack. /usr/bin is linked first and existing names are skipped, so the order matches the old /usr/bin:/bin PATH. On merged-usr hosts, the duplicate /bin entries are skipped.

#	Severity	Finding	Resolution
—	P4	If /usr/bin holds a dangling symlink (for example a broken /etc/alternatives target) on a merged-usr host, [ -e ] is false for the copied link, so the /bin pass prints ln: … File exists to stderr. The suite is set -u only, so this is noise, not a failure. [ -e x ] || [ -L x ] would silence it.	Observation only

Verified: I ran this on a host with /usr/bin/npm and /usr/bin/pnpm. The base version of tests/release-age.test.sh, run in place, gave 1 failed (no-npm-message: "npm 10.9.9 predates min-release-age"). The PR head gave all passed in 1.5 s. shellcheck is clean and shfmt -i 2 -d shows no diff. setup.sh only checks npm/pnpm with platform::command_exists, so leaving out those names is enough.
Fix commit: none pushed
Reviewed head: d0a5734

Verdict: approve

via gantry