chore(hygiene): harden multi-OS CI matrix, workflow concurrency, and contract test suite [Pfad A]

Author: lukisch

.github/workflows/tests.yml

@@ -7,24 +7,29 @@ on:
     branches: [master, main]
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   test:
-    name: Node.js ${{ matrix.node-version }}
-    runs-on: ubuntu-latest
+    name: Node.js ${{ matrix.node-version }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
         node-version: [20, 22, 24]
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.3.23] - 2026-08-24
+
+### CI/CD Workflow Härtung & Multi-OS Matrix
+- Hardened GitHub Actions test workflow (`.github/workflows/tests.yml`) with a full multi-OS matrix (`ubuntu-latest`, `windows-latest`, `macos-latest`) across Node.js 20, 22, and 24.
+- Standardized action versions to `actions/checkout@v4` and `actions/setup-node@v4`.
+- Added workflow-level concurrency control (`group: ${{ github.workflow }}-${{ github.ref }}` with `cancel-in-progress: true`) to automatically cancel superseded workflow runs.
+
+### Automated Metadata & Contract Test Suite
+- Expanded contract test suite in `test/metadata.test.ts` to 15 tests (15/15 passed) covering multi-OS CI matrix declarations, concurrency configuration, package.json URLs and metadata integrity (`repository`, `bugs`, `homepage`, `type: module`), TypeScript strict compiler configuration (`tsconfig.json`), and package payload export lists.
+- Synchronized Shields.io test badge to `186 passed` Vitest tests and total 264 verified test assertions (186 Vitest unit tests, 35 MCP stdio integration tests, 43 i18n translation assertions).
+- Updated `llms.txt` discovery index with `Last-checked: 2026-08-24`, 264 verified test assertions, and multi-OS CI matrix documentation.
+
 ## [1.3.23] - 2026-08-21
 
 ### Discoverability & Documentation Architecture

README.md

@@ -10,7 +10,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![npm version](https://img.shields.io/npm/v/ellmos-codecommander-mcp.svg)](https://www.npmjs.com/package/ellmos-codecommander-mcp)
 [![CodeCommander tests](https://github.com/ellmos-ai/ellmos-codecommander-mcp/actions/workflows/tests.yml/badge.svg)](https://github.com/ellmos-ai/ellmos-codecommander-mcp/actions/workflows/tests.yml)
-[![Vitest](https://img.shields.io/badge/Vitest-183%20passed-brightgreen.svg)](https://vitest.dev/)
+[![Vitest](https://img.shields.io/badge/Vitest-186%20passed-brightgreen.svg)](https://vitest.dev/)
 [![Node.js](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org/)
 [![Platform](https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-lightgrey.svg)](https://nodejs.org/)
 [![Privacy](https://img.shields.io/badge/Privacy-100%25%20Offline%20%7C%20Zero--Egress-success.svg)](SECURITY.md)

README_de.md

@@ -11,7 +11,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![npm version](https://img.shields.io/npm/v/ellmos-codecommander-mcp.svg)](https://www.npmjs.com/package/ellmos-codecommander-mcp)
 [![CodeCommander tests](https://github.com/ellmos-ai/ellmos-codecommander-mcp/actions/workflows/tests.yml/badge.svg)](https://github.com/ellmos-ai/ellmos-codecommander-mcp/actions/workflows/tests.yml)
-[![Vitest](https://img.shields.io/badge/Vitest-183%20passed-brightgreen.svg)](https://vitest.dev/)
+[![Vitest](https://img.shields.io/badge/Vitest-186%20passed-brightgreen.svg)](https://vitest.dev/)
 [![Node.js](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org/)
 [![Platform](https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-lightgrey.svg)](https://nodejs.org/)
 [![Privacy](https://img.shields.io/badge/Privacy-100%25%20Offline%20%7C%20Zero--Egress-success.svg)](SECURITY.md)

llms.txt

@@ -8,7 +8,7 @@ Node.js >= 20, MIT. Published as `ellmos-codecommander-mcp` 1.3.23 on npm. Visib
 
 Security invariants: 100% offline stdio JSON-RPC transport (Zero-Egress), preview-safe mutation modes (`mode: "preview"`), automatic `.bak` backups before modifying files, and standard unprivileged user-mode execution.
 
-Test gates: `npm test` runs 183 Vitest tests; `npm run test:integration` runs 35 real MCP stdio assertions after `npm run build`; `npm run test:i18n` runs 43 translation assertions (261 automated assertions total). GitHub Actions executes all three gates on Node.js 20, 22, and 24.
+Test gates: `npm test` runs 186 Vitest tests; `npm run test:integration` runs 35 real MCP stdio assertions after `npm run build`; `npm run test:i18n` runs 43 translation assertions (264 automated assertions total). GitHub Actions executes all three gates across Ubuntu, Windows, and macOS on Node.js 20, 22, and 24 with concurrency control.
 
 ## Docs
 
@@ -65,4 +65,4 @@ BACH Python runtime import diagnose structural edit indentation checker code gen
 regex tester format conversion markdown PDF MCP
 ```
 
-## Last-checked: 2026-08-21 (261 tests passed: 183 Vitest, 35 MCP stdio integration, 43 i18n assertions)
+## Last-checked: 2026-08-24 (264 tests passed: 186 Vitest, 35 MCP stdio integration, 43 i18n assertions)

test/metadata.test.ts

@@ -9,7 +9,22 @@ type PackageMetadata = {
   name: string;
   version: string;
   mcpName: string;
+  author?: string;
+  license?: string;
+  type?: string;
   files?: string[];
+  repository?: { type: string; url: string };
+  bugs?: { url: string };
+  homepage?: string;
+};
+
+type TsConfigMetadata = {
+  compilerOptions?: {
+    target?: string;
+    module?: string;
+    moduleResolution?: string;
+    strict?: boolean;
+  };
 };
 
 type ServerMetadata = {
@@ -108,7 +123,7 @@ describe("project metadata", () => {
       expect(content).toContain("badge/LLM--Ready-llms.txt-blue.svg");
       expect(content).toContain("https://github.com/ellmos-ai");
       expect(content).toContain("https://github.com/open-bricks");
-      expect(content).toContain("badge/Vitest-183%20passed-brightgreen.svg");
+      expect(content).toContain("badge/Vitest-186%20passed-brightgreen.svg");
       expect(content).toContain("badge/Privacy-100%25%20Offline%20%7C%20Zero--Egress-success.svg");
       expect(content).toContain("badge/Security-Local--First%20%7C%20Preview--Safe-blue.svg");
     }
@@ -122,8 +137,8 @@ describe("project metadata", () => {
     expect(llms).toContain("22 tools");
     expect(llms).toContain("ellmos-filecommander-mcp");
     expect(llms).toContain("open-bricks");
-    expect(llms).toContain("Last-checked: 2026-08-21");
-    expect(llms).toContain("261 tests passed");
+    expect(llms).toContain("Last-checked: 2026-08-24");
+    expect(llms).toContain("264 tests passed");
     expect(llms).toContain("Zero-Egress");
   });
 
@@ -137,14 +152,53 @@ describe("project metadata", () => {
     expect(sec).toContain("Subprocess Isolation");
   });
 
-  it("verifies GitHub Actions CI workflow matrices include Node 20, 22, and 24", async () => {
+  it("verifies GitHub Actions CI workflow matrices include Node 20, 22, and 24 across multi-OS with concurrency", async () => {
     const ci = await readText(".github/workflows/tests.yml");
     expect(ci).toContain("[20, 22, 24]");
+    expect(ci).toContain("[ubuntu-latest, windows-latest, macos-latest]");
+    expect(ci).toContain("actions/checkout@v4");
+    expect(ci).toContain("actions/setup-node@v4");
+    expect(ci).toContain("cancel-in-progress: true");
     expect(ci).toContain("npm test");
     expect(ci).toContain("npm run test:integration");
     expect(ci).toContain("npm run test:i18n");
   });
 
+  it("verifies package.json repository URLs, bugs tracker, author, and homepage integrity", async () => {
+    const pkg = await readJson<PackageMetadata>("package.json");
+    expect(pkg.repository?.url).toBe("git+https://github.com/ellmos-ai/ellmos-codecommander-mcp.git");
+    expect(pkg.bugs?.url).toBe("https://github.com/ellmos-ai/ellmos-codecommander-mcp/issues");
+    expect(pkg.homepage).toBe("https://github.com/ellmos-ai/ellmos-codecommander-mcp#readme");
+    expect(pkg.license).toBe("MIT");
+    expect(pkg.type).toBe("module");
+  });
+
+  it("verifies TypeScript compiler configuration enforces strict mode and ES2022 target", async () => {
+    const tsconfig = await readJson<TsConfigMetadata>("tsconfig.json");
+    expect(tsconfig.compilerOptions?.strict).toBe(true);
+    expect(tsconfig.compilerOptions?.target).toBe("ES2022");
+    expect(tsconfig.compilerOptions?.moduleResolution).toBe("Node16");
+  });
+
+  it("verifies package payload includes all essential documentation, schemas, and entrypoints", async () => {
+    const pkg = await readJson<PackageMetadata>("package.json");
+    const essentialFiles = [
+      "dist/",
+      "LICENSE",
+      "README.md",
+      "README_de.md",
+      "CHANGELOG.md",
+      "SECURITY.md",
+      "server.json",
+      "glama.json",
+      "smithery.yaml",
+      "llms.txt",
+    ];
+    for (const f of essentialFiles) {
+      expect(pkg.files).toContain(f);
+    }
+  });
+
   it("verifies Mermaid diagrams in both English and German READMEs", async () => {
     const readmeEn = await readText("README.md");
     const readmeDe = await readText("README_de.md");