test: add coverage for export link pages, GHA onboarding, and OAS discovery

[cursor]

🪛 Changes

Adds focused regression tests for export, GitHub Action onboarding, OpenAPI discovery, and shared upload/API paths that still had weak coverage after #1523 and #1524. No production behavior was changed.

Risky behavior now covered

• --docs-only link exports: empty type: link pages are still written and keep content.link. This is the documented exception from fix(export): honor --docs-only when skipping empty pages #1523; without it, reference/docs grouping links disappear on export-then-upload.
• Export safety and cleanup: pages whose parent URI decodes to a path-traversal segment are skipped; a failed categories request removes .temp_download instead of leaving a partial tree.
• createGHA git gates: not-a-repo, no remotes, unreachable remotes, and non-GitHub remotes skip onboarding (the oclif-hook versions of these cases remain it.skip). --github still forces onboarding; the workflow directory is created when missing; the process chdirs to the repo root before writing.
• Workflow command string: --key is replaced with secrets.README_API_KEY, --github is omitted, and commands without a key do not ask the user to create that secret.
• OpenAPI discovery: openapi validate errors when no definition is found, and in CI it refuses to pick among multiple discovered files.
• API v2 client: Warning headers are surfaced; URL specs set x-readme-source-url.
• Upload ordering / frontmatter / prerun: string position values sort numerically; a legacy link field merges onto an existing content object; login that does not persist a key fails closed; commands without --key skip flag rewriting.
• isSafePathSegment: rejects foo..bar (embedded .. without slashes).

Test files added/updated

• test/commands/pages/export.test.ts
• test/commands/pages/upload.test.ts
• test/commands/openapi/validate.test.ts
• test/lib/createGHA.test.ts
• test/lib/fetch.test.ts
• test/lib/frontmatter.test.ts
• test/lib/hooks.test.ts
• test/lib/safePath.test.ts

Why these tests materially reduce regression risk

These paths sit on export-then-upload, GHA onboarding, and spec discovery. A silent change can drop link grouping pages, write outside the export tree, prompt for a workflow in GitLab/CI, pick the wrong OpenAPI file in CI, or upload children before parents when position is quoted in YAML. The new tests assert those contracts directly instead of relying on skipped hook tests or snapshots.

🫈 QA & Testing

npx vitest run test/commands/pages/export.test.ts test/commands/pages/upload.test.ts test/commands/openapi/validate.test.ts test/lib/createGHA.test.ts test/lib/fetch.test.ts test/lib/frontmatter.test.ts test/lib/hooks.test.ts test/lib/safePath.test.ts

366 targeted tests passed (15 skipped, 10 todo). No production behavior was changed.

  

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
test/commands/pages/export.test.ts	Adds coverage for link-page exports, cleanup, recursive discovery, malformed metadata, and export-path containment.
test/commands/pages/upload.test.ts	Adds upload regression coverage for invalid metadata, ordering, and shared page-processing behavior.
test/lib/createGHA.test.ts	Expands coverage for repository eligibility gates, forced onboarding, workflow creation, and repository-root handling.
test/commands/openapi/validate.test.ts	Covers missing, ambiguous, and conversion-failing OpenAPI definitions.
test/commands/docs/migrate.test.ts	Exercises migration hook failures, transformed output, statistics, validation bypass, and zipped input handling.
test/lib/fetch.test.ts	Adds API warning-header and OpenAPI source-URL coverage.
test/lib/safePath.test.ts	Extends path-segment safety coverage to embedded traversal markers.

_{Reviews (4): Last reviewed commit: "chore: refresh GitHub Actions workflow J..." | Re-trigger Greptile}