refactor: embed import e2e tests into each feature test file

[dyoshikawa]

Summary

• Removed standalone e2e-import.spec.ts and distributed import tests into their respective feature e2e test files
• Added import tests for all 7 features: rules, mcp, commands, subagents, skills, hooks, ignore
• Fixed toRulesyncMcpDefault and CodexcliMcp.toRulesyncMcp to use recommended mcp.json filename instead of legacy .mcp.json

Test plan

• All 53 e2e tests pass (pnpm vitest run --config vitest.e2e.config.ts)
• All 4277 unit tests pass (pnpm cicheck:code)

🤖 Generated with Claude Code

[github-actions]

PR #1291 Review Summary

Overall Mergeability Verdict: ✅ MERGEABLE

All issues identified are low severity or lower. The "medium" issues are suggestions for future improvements rather than blockers.

---

Code Review Findings

1. [MEDIUM] Inconsistent import test coverage - Import tests only test a single target (claudecode for most features, cursor for ignore). While generate tests use it.each for multiple targets, import tests verify a representative target. This is acceptable since import logic is shared across targets.

2. [MEDIUM] Missing test for multiple targets import in MCP - Generate tests cover 4 targets but import only covers claudecode. Similar to fix: Update pnpm version to 10.12.2 in CI and release workflows #1, this is acceptable as import processor logic is shared.

3. [LOW] Potential DRY violation in test setup - Each import test recreates similar setup content patterns. Consider extracting common test fixtures if this grows.

4. [LOW] Missing env parameter in runImport - runGenerate has env support but runImport doesn't. Not currently needed but inconsistent API.

5. [POSITIVE] Good practices observed:

   • Consistent test structure across all 7 feature files
   • Proper use of RULESYNC_MCP_FILE_NAME constant per coding guidelines
   • Clean runImport helper function following existing patterns
   • Co-located tests improve discoverability

---

Security Review Findings

6. [INFO] Command execution security ✅ - Uses execFileAsync with array arguments (prevents shell injection). No security issues.

7. [INFO] Environment variable validation ✅ - RULESYNC_CMD is properly validated to ensure it's in dist-bun directory with rulesync- prefix.

8. [INFO] Path traversal protection ✅ - Existing checkPathTraversal function is used throughout. No new vulnerabilities introduced.

9. [INFO] Input validation ✅ - Targets and features are validated against whitelisted Zod schemas.

10. [INFO] No GitHub Actions changes - No workflow modifications that could introduce script injection.

---

Conclusion: PR is ready to merge. Consider #1-4 as future improvements, not blockers.

github run