ci: test the Cloudflare worker; normalize action pins to latest

Adds worker/index.test.js (22 cases driving the fetch handler end-to-end with
the upstream TSV fetches stubbed) and worker/package.json marking the worker as
an ESM module. A new worker.yml workflow runs the tests via the Node built-in
runner (no install) on worker/** changes; build.yml ignores worker/** so a
worker-only change no longer triggers the Java build.

Bumps every GitHub Actions pin to its latest release SHA: checkout v6.0.3,
setup-node v6.4.0, upload-artifact v7.0.1 (aligned across all workflows).

Author: raphw

.github/workflows/build.yml

@@ -4,10 +4,12 @@ on:
   push:
     paths-ignore:
       - 'data/**'
+      - 'worker/**'
       - '**/*.md'
   pull_request:
     paths-ignore:
       - 'data/**'
+      - 'worker/**'
       - '**/*.md'
   workflow_dispatch:
 
@@ -27,7 +29,7 @@ jobs:
 
     steps:
       - name: Check out repository (with submodules)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           submodules: recursive
 

.github/workflows/crawl.yml

@@ -75,7 +75,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 50
           persist-credentials: true
@@ -140,7 +140,7 @@ jobs:
 
       - name: Upload heap dump on failure
         if: ${{ failure() }}
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: crawl-heap-dump-${{ github.run_id }}
           path: crawl.hprof

.github/workflows/reconcile-metadata.yml

@@ -43,7 +43,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 50
           persist-credentials: true
@@ -85,7 +85,7 @@ jobs:
 
       - name: Upload heap dump on failure
         if: ${{ failure() }}
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: reconcile-heap-dump-${{ github.run_id }}
           path: reconcile.hprof

.github/workflows/release.yml

@@ -13,7 +13,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           fetch-tags: true

.github/workflows/summary.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 5
           persist-credentials: true

.github/workflows/worker.yml

@@ -0,0 +1,36 @@
+name: Test Cloudflare Worker
+
+# The worker (worker/index.js) is independent of the Java crawler, so it has its own
+# workflow gated on worker/** changes. Tests use the Node built-in test runner (node --test)
+# and have no dependencies, so there is no install step.
+on:
+  push:
+    paths:
+      - 'worker/**'
+      - '.github/workflows/worker.yml'
+  pull_request:
+    paths:
+      - 'worker/**'
+      - '.github/workflows/worker.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '22'
+
+      - name: Run worker tests
+        working-directory: worker
+        run: node --test

README.md

@@ -263,6 +263,8 @@ The contents of `data/modules/` are published as the **Jenesis Module Repository
 
 The repository is intentionally a thin wrapper over the resolved views: every redirect target is derivable from a single row of `artifacts.tsv` or `modules.tsv`. Consumers that prefer to do their own lookup can read the TSVs directly via `raw.githubusercontent.com` (or any mirror); the worker exists so a Maven-style `<repository>` URL can be plugged in without writing a resolver.
 
+The worker is covered by `worker/index.test.js`, which drives the `fetch` handler end-to-end (routing, TSV parsing, row selection, redirect-URL construction, error mapping) with the upstream TSV fetches stubbed. The tests use the Node built-in test runner and have no dependencies - run them with `node --test` from the `worker/` directory (Node 20+). The `.github/workflows/worker.yml` workflow runs them on every push or pull request that touches `worker/**`.
+
 ### URL shapes
 
 Four modes, distinguished by the path segment immediately before the module name:

worker/index.test.js

@@ -0,0 +1,244 @@
+/**
+ * Tests for the Cloudflare Worker in index.js.
+ *
+ * The worker is exercised end-to-end through its `fetch(request, env)` handler - the same
+ * entry point Cloudflare invokes - so routing, TSV parsing, row selection, redirect-URL
+ * construction and error mapping are all covered by real requests rather than by reaching
+ * into private helpers. The only thing stubbed is the global `fetch` the worker uses to pull
+ * `*.tsv` files from `DATA_BASE`: each test supplies the TSV bodies it needs keyed by the
+ * path suffix the worker requests.
+ *
+ * Runs on the Node built-in test runner with no dependencies: `node --test` (Node 20+).
+ * `Request`, `Response`, `URL` and `fetch` are Web-standard globals in Node 18+, matching
+ * the workerd runtime closely enough for these resolution tests.
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import worker from "./index.js";
+
+const DATA_BASE = "https://data.test/";
+const ARTIFACT_BASE = "https://maven.test/";
+const ENV = { DATA_BASE, ARTIFACT_BASE };
+
+const tsv = (rows) => rows.map((cols) => cols.join("\t")).join("\n") + "\n";
+
+// org.slf4j: a plain, named module with both an artifacts and a modules view.
+const SLF4J_ARTIFACTS = tsv([
+    ["2.0.10", "named", "org.slf4j", "slf4j-api"],
+    ["2.0.9", "named", "org.slf4j", "slf4j-api"],
+    ["1.7.36", "named", "org.slf4j", "slf4j-api"],
+]);
+const SLF4J_MODULES = tsv([
+    ["2.0.10", "org.slf4j", "slf4j-api", "2.0.10"],
+    ["2.0.9", "org.slf4j", "slf4j-api", "2.0.9"],
+]);
+// A classifier-scoped artifacts view (jackson's no_aopalliance variant).
+const JACKSON_NOAOP = tsv([
+    ["2.17.0", "named", "com.fasterxml.jackson.core", "jackson-core"],
+]);
+
+const FIXTURES = {
+    "org/slf4j/artifacts.tsv": SLF4J_ARTIFACTS,
+    "org/slf4j/modules.tsv": SLF4J_MODULES,
+    "com/fasterxml/jackson/core/artifacts-no_aopalliance.tsv": JACKSON_NOAOP,
+};
+
+/**
+ * Drive the worker for one request. `files` maps a TSV path suffix to either a string body
+ * (served as 200) or `{ status, body }` to simulate upstream errors / 404s. Falls back to
+ * FIXTURES, then to a 404, so most tests only declare what differs.
+ */
+async function call(path, { files = {}, env = ENV, method = "GET" } = {}) {
+    const saved = globalThis.fetch;
+    globalThis.fetch = async (url) => {
+        const u = String(url);
+        const table = { ...FIXTURES, ...files };
+        for (const [suffix, value] of Object.entries(table)) {
+            if (u.endsWith(suffix)) {
+                if (typeof value === "string") {
+                    return new Response(value, { status: 200 });
+                }
+                return new Response(value.body ?? "", { status: value.status });
+            }
+        }
+        return new Response("not found", { status: 404 });
+    };
+    try {
+        const request = new Request("https://worker.test" + path, { method });
+        return await worker.fetch(request, env);
+    } finally {
+        globalThis.fetch = saved;
+    }
+}
+
+test("root path redirects to the default home", async () => {
+    const response = await call("/", { env: {} });
+    assert.equal(response.status, 302);
+    assert.equal(response.headers.get("Location"), "https://github.com/raphw/jenesis-modules");
+});
+
+test("root path honours HOME_REDIRECT override", async () => {
+    const response = await call("/", { env: { HOME_REDIRECT: "https://example.org/home" } });
+    assert.equal(response.status, 302);
+    assert.equal(response.headers.get("Location"), "https://example.org/home");
+});
+
+test("non-GET/HEAD methods are rejected with 405 and an Allow header", async () => {
+    const response = await call("/artifact/org.slf4j/org.slf4j.jar", { method: "POST" });
+    assert.equal(response.status, 405);
+    assert.equal(response.headers.get("Allow"), "GET, HEAD");
+});
+
+test("HEAD is allowed and resolves like GET", async () => {
+    const response = await call("/artifact/org.slf4j/org.slf4j.jar", { method: "HEAD" });
+    assert.equal(response.status, 302);
+    assert.equal(
+        response.headers.get("Location"),
+        "https://maven.test/org/slf4j/slf4j-api/2.0.10/slf4j-api-2.0.10.jar",
+    );
+});
+
+test("a path with too few segments is a 404", async () => {
+    const response = await call("/artifact/org.slf4j");
+    assert.equal(response.status, 404);
+});
+
+test("artifact mode without a version redirects to the newest Maven coordinate", async () => {
+    const response = await call("/artifact/org.slf4j/org.slf4j.jar");
+    assert.equal(response.status, 302);
+    assert.equal(
+        response.headers.get("Location"),
+        "https://maven.test/org/slf4j/slf4j-api/2.0.10/slf4j-api-2.0.10.jar",
+    );
+    assert.equal(response.headers.get("X-Jenesis-GroupId"), "org.slf4j");
+    assert.equal(response.headers.get("X-Jenesis-ArtifactId"), "slf4j-api");
+    assert.equal(response.headers.get("X-Jenesis-MavenVersion"), "2.0.10");
+});
+
+test("artifact mode resolves an explicit Maven version present in the TSV", async () => {
+    const response = await call("/artifact/org.slf4j/2.0.9/org.slf4j.jar");
+    assert.equal(response.status, 302);
+    assert.equal(
+        response.headers.get("Location"),
+        "https://maven.test/org/slf4j/slf4j-api/2.0.9/slf4j-api-2.0.9.jar",
+    );
+});
+
+test("artifact mode passes the request extension through verbatim (.pom)", async () => {
+    const response = await call("/artifact/org.slf4j/2.0.9/org.slf4j.pom");
+    assert.equal(response.status, 302);
+    assert.equal(
+        response.headers.get("Location"),
+        "https://maven.test/org/slf4j/slf4j-api/2.0.9/slf4j-api-2.0.9.pom",
+    );
+});
+
+test("artifact mode passes a multi-dot extension through (.pom.sha256)", async () => {
+    const response = await call("/artifact/org.slf4j/2.0.9/org.slf4j.pom.sha256");
+    assert.equal(response.status, 302);
+    assert.equal(
+        response.headers.get("Location"),
+        "https://maven.test/org/slf4j/slf4j-api/2.0.9/slf4j-api-2.0.9.pom.sha256",
+    );
+});
+
+test("a classifier flips the lookup to the classifier-scoped TSV and decorates the filename", async () => {
+    const response = await call(
+        "/artifact/com.fasterxml.jackson.core/com.fasterxml.jackson.core-no_aopalliance.pom",
+    );
+    assert.equal(response.status, 302);
+    assert.equal(
+        response.headers.get("Location"),
+        "https://maven.test/com/fasterxml/jackson/core/jackson-core/2.17.0/jackson-core-2.17.0-no_aopalliance.pom",
+    );
+});
+
+test("module mode resolves via modules.tsv (module-info version keys the row)", async () => {
+    const response = await call("/module/org.slf4j/2.0.9/org.slf4j.jar");
+    assert.equal(response.status, 302);
+    assert.equal(
+        response.headers.get("Location"),
+        "https://maven.test/org/slf4j/slf4j-api/2.0.9/slf4j-api-2.0.9.jar",
+    );
+    assert.equal(response.headers.get("X-Jenesis-ModuleVersion"), "2.0.9");
+    assert.equal(response.headers.get("X-Jenesis-MavenVersion"), "2.0.9");
+});
+
+test("module mode only accepts a .jar filename", async () => {
+    const response = await call("/module/org.slf4j/org.slf4j.pom");
+    assert.equal(response.status, 404);
+});
+
+test("sources mode synthesises the -sources.jar URL", async () => {
+    const response = await call("/sources/org.slf4j/2.0.9/org.slf4j.jar");
+    assert.equal(response.status, 302);
+    assert.equal(
+        response.headers.get("Location"),
+        "https://maven.test/org/slf4j/slf4j-api/2.0.9/slf4j-api-2.0.9-sources.jar",
+    );
+});
+
+test("documentation mode synthesises the -javadoc.jar URL", async () => {
+    const response = await call("/documentation/org.slf4j/2.0.9/org.slf4j.jar");
+    assert.equal(response.status, 302);
+    assert.equal(
+        response.headers.get("Location"),
+        "https://maven.test/org/slf4j/slf4j-api/2.0.9/slf4j-api-2.0.9-javadoc.jar",
+    );
+});
+
+test("an unknown explicit version resolves best-effort against the newest coordinate", async () => {
+    const response = await call("/artifact/org.slf4j/9.9.9/org.slf4j.jar");
+    assert.equal(response.status, 302);
+    assert.equal(
+        response.headers.get("Location"),
+        "https://maven.test/org/slf4j/slf4j-api/9.9.9/slf4j-api-9.9.9.jar",
+    );
+    assert.equal(response.headers.get("X-Jenesis-BestEffort"), "true");
+});
+
+test("an unknown module (TSV 404 upstream) returns 404", async () => {
+    const response = await call("/artifact/org.unknown/org.unknown.jar", {
+        files: { "org/unknown/artifacts.tsv": { status: 404 } },
+    });
+    assert.equal(response.status, 404);
+});
+
+test("an empty TSV with no rows returns 404", async () => {
+    const response = await call("/artifact/org.empty/org.empty.jar", {
+        files: { "org/empty/artifacts.tsv": "" },
+    });
+    assert.equal(response.status, 404);
+});
+
+test("a non-404 upstream error maps to 502", async () => {
+    const response = await call("/artifact/org.slf4j/org.slf4j.jar", {
+        files: { "org/slf4j/artifacts.tsv": { status: 500 } },
+    });
+    assert.equal(response.status, 502);
+});
+
+test("path segments before the mode marker are ignored", async () => {
+    const response = await call("/jenesis/v1/artifact/org.slf4j/org.slf4j.jar");
+    assert.equal(response.status, 302);
+    assert.equal(
+        response.headers.get("Location"),
+        "https://maven.test/org/slf4j/slf4j-api/2.0.10/slf4j-api-2.0.10.jar",
+    );
+});
+
+test("the module-name segment must prefix the filename", async () => {
+    const response = await call("/artifact/org.slf4j/com.other.jar");
+    assert.equal(response.status, 404);
+});
+
+test("an invalid module name (hyphen in a segment) is a 404", async () => {
+    const response = await call("/artifact/foo-bar/foo-bar.jar");
+    assert.equal(response.status, 404);
+});
+
+test("an unknown mode marker is a 404", async () => {
+    const response = await call("/bogus/org.slf4j/org.slf4j.jar");
+    assert.equal(response.status, 404);
+});

worker/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "jenesis-modules-worker",
+  "version": "0.0.0",
+  "private": true,
+  "description": "Cloudflare Worker resolving Java module names to Maven Central artifacts",
+  "type": "module",
+  "scripts": {
+    "test": "node --test"
+  }
+}