test(node): restore test-node as a real Node-runtime suite

[dmythro]

What

Restores packages/test-node as a genuine Node.js test of the published bundles, replacing the stray Bun-only file that nothing ran.

• gives test-node a package.json again (node --test, Node's native TS type-stripping — no loader needed)
• rewrites index.test.ts to load the built dist under Node's real CJS (require) and ESM (import) loaders, for both entry points (. and ./currencies) — never the .ts source
• adds a dedicated Node 24 job to build-test.yml

Why

test-node was a real Node-runtime package until the Oct-2025 rename to test-js moved its package.json away, leaving a leftover index.test.ts that imported bun:test + .ts source and was wired into no script or workflow. Bun-only CI doesn't validate that the shipped CJS/ESM bundles actually execute under Node — the runtime most consumers use. This restores that guarantee (and would catch packaging/interop regressions Bun papers over).

Notes

• The CI step calls node --test directly, not via bun run — bunfig.toml [run] bun = true re-routes node to Bun, which would defeat the purpose.
• Verified locally (Node 26): 4/4 pass — CJS + ESM × main + currencies.
• Added packages/test-node/** to the workflow path filter so changes trigger CI.

[coderabbitai]

📝 Walkthrough

Walkthrough

A new test-node workspace package is introduced to validate the built dist artifacts under the real Node.js runtime. packages/test-node/package.json declares the package as private ESM and adds a node --test script. packages/test-node/index.test.ts is rewritten from Bun-based assertions to Node.js-native node:test/assert, using createRequire for CJS entry loading and dynamic import() for ESM, with coverage for both the main entrypoint and the currencies subpath. The CI workflow gains a packages/test-node/** path trigger and a new test-node job that sets up Bun 1.3.3 and Node 24, builds the dist, then executes the Node test suite.

Poem

A rabbit hops to Node's own test floor,
No Bun imports needed anymore!
CJS and ESM, both checked with care,
getEmojiFlag('UA') flying through air.
The CI job watches each dist artifact laid—
🐇 Green checks all around, no bun betrayed!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'test(node): restore test-node as a real Node-runtime suite' is concise, specific, and clearly summarizes the main objective of restoring Node.js runtime testing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The PR description comprehensively addresses the context, motivations, and implementation details of the changes.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test/test-node-runtime

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Restores packages/test-node as an actual Node.js runtime test suite to validate that the built dist/ bundles execute correctly under Node’s CJS (require) and ESM (import) loaders, and wires it into CI.

Changes:

• Reintroduces packages/test-node/package.json with a Node-native test script.
• Rewrites packages/test-node/index.test.ts to validate loading built dist/ artifacts under Node (CJS + ESM), including the currencies subpath.
• Adds a dedicated Node 24 CI job and expands workflow path filters to trigger it.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.

File	Description
packages/test-node/package.json	Re-adds a minimal Node test package manifest and node --test script.
packages/test-node/index.test.ts	Implements Node-based tests that load built dist/ bundles via CJS/ESM.
bun.lock	Registers test-node as a Bun workspace package.
.github/workflows/build-test.yml	Adds a Node 24 job to build dist/ and run the Node runtime tests; updates path filters.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/build-test.yml:
- Line 53: The GitHub Actions setup steps are using unpinned version tags which
creates a supply-chain security risk. Replace the version tag references for
both the oven-sh/setup-bun action (currently `@v2`) and the actions/setup-node
action (currently `@v6`) with pinned commit SHAs instead, following GitHub's
security best practice of pinning external actions to specific commits rather
than mutable version tags. Apply this change consistently across all occurrences
of these actions in the workflow file.
- Line 50: The `actions/checkout@v6` action reference needs to be pinned to a
specific commit SHA instead of using a version tag, and the
`persist-credentials` option must be explicitly set to `false` to mitigate
supply-chain attack risks and prevent credential exposure. Update the checkout
action invocation to include the commit SHA in the reference (e.g.,
`actions/checkout@<SHA>`) and add `persist-credentials: false` to the action
configuration. Apply this same security fix to all instances of
`actions/checkout` throughout the workflow file for consistency.

In `@packages/test-node/package.json`:
- Line 6: Add a trailing comma after the test script value in the package.json
file. The line with "test": "node --test ./*.test.ts" needs a comma appended to
the closing quote to comply with the ES5 trailing comma coding guideline used
across the project.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: fcee138f-4e06-4bf4-b4d2-566ad8c98b71

📥 Commits

Reviewing files that changed from the base of the PR and between a6d63f6 and 5b2bdf6.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• .github/workflows/build-test.yml
• packages/test-node/index.test.ts
• packages/test-node/package.json

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.