Add CI/publish workflows and petstore integration test

- CI workflow: lint, test, build on push/PR to main (uses mise-action)
- Publish workflow: npm trusted publishing via OIDC on GitHub release
- Integration test: request limiting against live Petstore API

Author: robinbraemer

.github/workflows/ci.yml

@@ -0,0 +1,19 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: jdx/mise-action@v2
+
+      - run: task install
+
+      - run: task ci

.github/workflows/publish.yml

@@ -0,0 +1,22 @@
+name: Publish
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: jdx/mise-action@v2
+
+      - run: task install
+
+      - run: task ci
+
+      - run: pnpm publish --access public --no-git-checks

test/petstore-limit.test.ts

@@ -0,0 +1,167 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { CodeMode } from "../src/codemode.js";
+import type { Executor, ExecuteResult } from "../src/types.js";
+
+const PETSTORE_BASE = "https://petstore3.swagger.io";
+
+const petstoreSpec = {
+  openapi: "3.0.0",
+  info: { title: "Swagger Petstore", version: "1.0.27" },
+  paths: {
+    "/api/v3/pet/findByStatus": {
+      get: { summary: "Finds Pets by status", operationId: "findPetsByStatus" },
+    },
+    "/api/v3/store/inventory": {
+      get: { summary: "Returns pet inventories by status", operationId: "getInventory" },
+    },
+    "/api/v3/user/login": {
+      get: { summary: "Logs user into the system", operationId: "loginUser" },
+    },
+  },
+};
+
+class TestExecutor implements Executor {
+  async execute(
+    code: string,
+    globals: Record<string, unknown>,
+  ): Promise<ExecuteResult> {
+    const globalNames = Object.keys(globals);
+    const globalValues = Object.values(globals);
+    const noopConsole = { log: () => {}, warn: () => {}, error: () => {} };
+
+    try {
+      const fn = new Function("console", ...globalNames, `return (${code})();`);
+      const result = await fn(noopConsole, ...globalValues);
+      return { result };
+    } catch (err) {
+      return {
+        result: undefined,
+        error: err instanceof Error ? err.message : String(err),
+      };
+    }
+  }
+}
+
+describe("request limiting against live Petstore API", () => {
+  let cm: CodeMode;
+
+  afterEach(() => {
+    cm?.dispose();
+  });
+
+  it("allows requests within the limit", async () => {
+    cm = new CodeMode({
+      spec: petstoreSpec,
+      request: fetch,
+      baseUrl: PETSTORE_BASE,
+      namespace: "petstore",
+      maxRequests: 3,
+      executor: new TestExecutor(),
+    });
+
+    const result = await cm.execute(`
+      async () => {
+        const r1 = await petstore.request({ method: "GET", path: "/api/v3/pet/findByStatus", query: { status: "available" } });
+        const r2 = await petstore.request({ method: "GET", path: "/api/v3/pet/findByStatus", query: { status: "sold" } });
+        return { count: 2, r1Status: r1.status, r2Status: r2.status };
+      }
+    `);
+
+    // We're testing that the request bridge didn't block these — not the petstore response codes
+    expect(result.isError).toBeUndefined();
+    const data = JSON.parse(result.content[0]!.text);
+    expect(data.count).toBe(2);
+    expect(typeof data.r1Status).toBe("number");
+    expect(typeof data.r2Status).toBe("number");
+  });
+
+  it("returns error (not crash) when limit exceeded", async () => {
+    cm = new CodeMode({
+      spec: petstoreSpec,
+      request: fetch,
+      baseUrl: PETSTORE_BASE,
+      namespace: "petstore",
+      maxRequests: 1,
+      executor: new TestExecutor(),
+    });
+
+    const result = await cm.execute(`
+      async () => {
+        await petstore.request({ method: "GET", path: "/api/v3/pet/findByStatus", query: { status: "available" } });
+        await petstore.request({ method: "GET", path: "/api/v3/user/login", query: { username: "test", password: "test" } });
+        return "should not reach here";
+      }
+    `);
+
+    expect(result.isError).toBe(true);
+    expect(result.content[0]!.text).toContain("Request limit exceeded");
+  });
+
+  it("resets counter between execute() calls", async () => {
+    cm = new CodeMode({
+      spec: petstoreSpec,
+      request: fetch,
+      baseUrl: PETSTORE_BASE,
+      namespace: "petstore",
+      maxRequests: 2,
+      executor: new TestExecutor(),
+    });
+
+    // First execution: 2 requests (at limit)
+    const r1 = await cm.execute(`
+      async () => {
+        await petstore.request({ method: "GET", path: "/api/v3/pet/findByStatus", query: { status: "available" } });
+        await petstore.request({ method: "GET", path: "/api/v3/user/login", query: { username: "test", password: "test" } });
+        return "first-ok";
+      }
+    `);
+    expect(r1.isError).toBeUndefined();
+    expect(r1.content[0]!.text).toBe("first-ok");
+
+    // Second execution: gets a fresh counter, should also succeed
+    const r2 = await cm.execute(`
+      async () => {
+        await petstore.request({ method: "GET", path: "/api/v3/pet/findByStatus", query: { status: "sold" } });
+        await petstore.request({ method: "GET", path: "/api/v3/user/login", query: { username: "a", password: "b" } });
+        return "second-ok";
+      }
+    `);
+    expect(r2.isError).toBeUndefined();
+    expect(r2.content[0]!.text).toBe("second-ok");
+  });
+
+  it("blocks exactly at the boundary", async () => {
+    cm = new CodeMode({
+      spec: petstoreSpec,
+      request: fetch,
+      baseUrl: PETSTORE_BASE,
+      namespace: "petstore",
+      maxRequests: 2,
+      executor: new TestExecutor(),
+    });
+
+    // 2 requests: OK (exactly at limit)
+    const ok = await cm.execute(`
+      async () => {
+        await petstore.request({ method: "GET", path: "/api/v3/pet/findByStatus", query: { status: "sold" } });
+        await petstore.request({ method: "GET", path: "/api/v3/user/login", query: { username: "test", password: "test" } });
+        return "within-limit";
+      }
+    `);
+    expect(ok.isError).toBeUndefined();
+    expect(ok.content[0]!.text).toBe("within-limit");
+
+    // 3 requests in a new execute(): should fail on the 3rd
+    const fail = await cm.execute(`
+      async () => {
+        await petstore.request({ method: "GET", path: "/api/v3/pet/findByStatus", query: { status: "available" } });
+        await petstore.request({ method: "GET", path: "/api/v3/pet/findByStatus", query: { status: "sold" } });
+        await petstore.request({ method: "GET", path: "/api/v3/user/login", query: { username: "a", password: "b" } });
+        return "should not reach here";
+      }
+    `);
+    expect(fail.isError).toBe(true);
+    expect(fail.content[0]!.text).toContain("Request limit exceeded");
+    expect(fail.content[0]!.text).toContain("max 2");
+  });
+});