ci(hubspot): add auth/API test receipt job

.github/workflows/hubspot-auth-api-receipt.yml

@@ -0,0 +1,114 @@
+# Binding C item 4a (rev2): synthetic auth/API test receipt for
+# packages/v1-ready/hubspot. Never contacts the live provider, never
+# reads secrets, never emits authorized/live, fails closed on HUBSPOT_*
+# or MATTERS_ACCESS_TOKEN.
+#
+# The receipt command MUST NOT be passed via a HUBSPOT_* env var
+# (that prefix is on the T-C4-8 abort list). Use AML_RECEIPT_COMMAND
+# or the CLI --command argument only.
+name: HubSpot auth/API test receipt
+
+on:
+  push:
+    paths:
+      - 'packages/v1-ready/hubspot/**'
+      - 'scripts/ci/**'
+      - '.github/workflows/hubspot-auth-api-receipt.yml'
+      - 'package-lock.json'
+  pull_request:
+    paths:
+      - 'packages/v1-ready/hubspot/**'
+      - 'scripts/ci/**'
+      - '.github/workflows/hubspot-auth-api-receipt.yml'
+      - 'package-lock.json'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  hubspot-auth-api-receipt:
+    name: Synthetic auth/API receipt
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Fail closed if provider token env is present (T-C4-8)
+        run: node scripts/ci/hubspot-auth-api-receipt.cjs --assert-offline-env
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 18
+          cache: npm
+
+      # Full lock-exact install. A workspace-filtered ci would miss
+      # @aws-sdk/client-scheduler, which @friggframework/core@2.0.0-next.89
+      # requires (but does not declare) when loading the HubSpot Api.
+      - name: Install (npm ci, lock exact)
+        run: npm ci --ignore-scripts
+
+      - name: Receipt script checks (T-C4-2..T-C4-10 policy)
+        run: node --test scripts/ci/hubspot-auth-api-receipt.test.cjs
+
+      - name: Run 4a HubSpot auth/API tests (JSON report)
+        id: tests
+        working-directory: packages/v1-ready/hubspot
+        continue-on-error: true
+        run: |
+          mkdir -p "${GITHUB_WORKSPACE}/artifacts"
+          npx jest --config jest.receipt.config.js --ci --watchman=false --forceExit \
+            --json --outputFile="${GITHUB_WORKSPACE}/artifacts/jest-results.json"
+
+      - name: Write receipt and classification bytes
+        env:
+          AML_RECEIPT_COMMAND: npx jest --config jest.receipt.config.js --ci --watchman=false --forceExit --json --outputFile=artifacts/jest-results.json
+        run: |
+          node scripts/ci/hubspot-auth-api-receipt.cjs \
+            --jest-json "${GITHUB_WORKSPACE}/artifacts/jest-results.json" \
+            --out "${GITHUB_WORKSPACE}/artifacts/hubspot-auth-api-receipt.json" \
+            --command "${AML_RECEIPT_COMMAND}" \
+            --classification synthetic \
+            --expect-classification synthetic \
+            --module-ref-branch next \
+            --module-ref-sha 9f5e5c627a0be42cd25cf28339142891e71eba07
+
+      - name: Packet classification must byte-equal the CI artifact (T-C4-2)
+        run: |
+          python3 - <<'PY'
+          from pathlib import Path
+          artifact = Path("artifacts/classification").read_bytes()
+          receipt = Path("artifacts/hubspot-auth-api-receipt.json").read_text()
+          import json
+          classify = json.loads(receipt)["classification"].encode("utf-8")
+          if artifact != classify or artifact != b"synthetic":
+              raise SystemExit(f"T-C4-2 mismatch: file={artifact!r} receipt={classify!r}")
+          print("T-C4-2: classification bytes equal", artifact)
+          PY
+
+      - name: Upload receipt artifact
+        # Only run (and therefore only claim success) when both files exist.
+        # hashFiles is empty when a path is missing; if: always() alone would
+        # still start the step and if-no-files-found: error would fail it,
+        # but a skipped upload must not be reported as a successful publish.
+        if: ${{ always() && hashFiles('artifacts/hubspot-auth-api-receipt.json') != '' && hashFiles('artifacts/classification') != '' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: hubspot-auth-api-receipt
+          path: |
+            artifacts/hubspot-auth-api-receipt.json
+            artifacts/classification
+          if-no-files-found: error
+
+      - name: Fail the job if tests or receipt failed
+        if: always()
+        run: |
+          if [ "${{ steps.tests.outcome }}" != "success" ]; then
+            echo "4a tests did not succeed (outcome=${{ steps.tests.outcome }})."
+            exit 1
+          fi
+          if [ ! -f artifacts/hubspot-auth-api-receipt.json ] || [ ! -f artifacts/classification ]; then
+            echo "Receipt or classification file missing."
+            exit 1
+          fi

packages/v1-ready/hubspot/jest.receipt.config.js

@@ -0,0 +1,22 @@
+/*
+ * Jest config for the Binding C item 4a receipt job.
+ *
+ * Omits the package's MongoMemoryServer globalSetup/Teardown: the 4a tests
+ * exercise Definition.requiredAuthMethods and Api against nock, and do not
+ * need a database. Full `npm test` (jest.config.js) still uses mongo and is
+ * excluded from this command (see the receipt exclusions).
+ */
+module.exports = {
+    testMatch: [
+        '<rootDir>/tests/auth-api-synthetic.test.js',
+        '<rootDir>/tests/definition.test.js',
+        '<rootDir>/tests/listContacts.test.js',
+        '<rootDir>/tests/oauth.test.js',
+    ],
+    testPathIgnorePatterns: [
+        '/node_modules/',
+        '/tests/api.test.js',
+        '/tests/auther.test.js',
+        '/tests/extensions/',
+    ],
+};

packages/v1-ready/hubspot/package.json

@@ -6,7 +6,8 @@
   "main": "index.js",
   "scripts": {
     "lint:fix": "prettier --write --loglevel error . && eslint . --fix",
-    "test": "jest"
+    "test": "jest",
+    "test:receipt": "jest --config jest.receipt.config.js"
   },
   "author": "",
   "license": "MIT",

packages/v1-ready/hubspot/tests/api.test.js

@@ -20,7 +20,13 @@ const parsedBody = async function async(resp) {
     return body;
 }
 
-describe(`${config.label} API tests`, () => {
+// Live interactive OAuth suite (Authenticator.oauth2). Not part of the
+// Binding C item 4a synthetic receipt. This CI job never sets
+// HUBSPOT_LIVE_API and does not wire tokens or secrets. The suite is
+// reported as skipped/excluded on the receipt. It is not a 4b path.
+const describeLiveApi = process.env.HUBSPOT_LIVE_API === '1' ? describe : describe.skip;
+
+describeLiveApi(`${config.label} API tests`, () => {
     const apiParams = {
         client_id: process.env.HUBSPOT_CLIENT_ID,
         client_secret: process.env.HUBSPOT_CLIENT_SECRET,