# Testing signals — ohmyzsh/ohmyzsh > Canonical page: https://codevetter.com/unpack/ohmyzsh/testing-signals # Testing signals — ohmyzsh/ohmyzsh Scanned commit 86ef6555e068663736a33376e4055aca9c1acc89 (2026-09-22). Generated by codevetter codevetter 1.12.0 on 2026-09-22. Testing is thin for a project of this reach. CI (main.yml) does only `zsh -n` syntax checking over the entrypoint, lib files, plugin entrypoints/completions, and themes — no behavioral test runs. Real tests exist but are scattered and not wired into workflows: lib/tests/cli.test.zsh exercises the plugin-disable awk script, and a few plugins (alias-finder, dotenv) ship zunit suites. The installer gets its own matrix test on ubuntu+macos, and all workflows run step-security/harden-runner in audit mode. - main.yml's only test step is a `zsh -n` syntax sweep over ./oh-my-zsh.sh, lib/*.zsh, plugins/*/*.plugin.zsh, plugins/*/_*, and themes/*.zsh-theme on ubuntu-latest; the job is gated on github.repository == 'ohmyzsh/ohmyzsh'. — [.github/workflows/main.yml#L20-43](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/.github/workflows/main.yml#L20-L43) - lib/tests/cli.test.zsh duplicates the plugin-disable awk program inline and tests it against oneline/multiline/mixed plugins=(...) formats, asserting both `zsh -n` validity and exact diff output via run_awk_and_test. — [lib/tests/cli.test.zsh#L1-169](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/lib/tests/cli.test.zsh#L1-L169) - The awk script tested by lib/tests/cli.test.zsh is a copy of the one embedded in _omz::plugin::disable in lib/cli.zsh, so the test validates a clone of the logic rather than the shipped code path. (inferred) — [lib/tests/cli.test.zsh#L9-55](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/lib/tests/cli.test.zsh#L9-L55) [lib/cli.zsh#L250-295](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/lib/cli.zsh#L250-L295) - Plugin-level tests exist in zunit format: plugins/alias-finder/tests/test_run.sh (@setup/@test/@assert blocks) and plugins/dotenv/tests/{basic-parsing,compatibility,security}.zunit. — [plugins/alias-finder/tests/test_run.sh](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/plugins/alias-finder/tests/test_run.sh) [plugins/dotenv/tests/security.zunit](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/plugins/dotenv/tests/security.zunit) - Neither the zunit suites nor cli.test.zsh are invoked by any workflow; grep of .github/workflows shows only the syntax-check job and the installer test, so these tests run only when a developer runs them manually. (inferred) — [.github/workflows/main.yml](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/.github/workflows/main.yml) [.github/workflows/installer.yml](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/.github/workflows/installer.yml) - installer.yml runs `sh ./tools/install.sh` on ubuntu-latest and macos-latest on pushes touching tools/install.sh, then deploys install.sh to Vercel (install.ohmyz.sh) on master via `vc deploy --prod` with VERCEL_* secrets. — [.github/workflows/installer.yml](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/.github/workflows/installer.yml) - Every workflow pins actions by SHA and prepends step-security/harden-runner with egress-policy: audit; permissions are minimal (contents: read) except dependencies.yml which grants contents: write for pushing update branches. — [.github/workflows/main.yml#L26-29](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/.github/workflows/main.yml#L26-L29) [.github/workflows/dependencies.yml#L16-24](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/.github/workflows/dependencies.yml#L16-L24) [.github/workflows/scorecard.yml](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/.github/workflows/scorecard.yml) - scorecard.yml runs OpenSSF Scorecard analysis weekly and on master pushes, uploading results to the code-scanning dashboard (security-events: write). — [.github/workflows/scorecard.yml](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/.github/workflows/scorecard.yml) - dependencies.yml runs updater.py weekly: it reads .github/dependencies.yml entries (upstream repo/branch/pinned version + precopy/postcopy shell), fetches upstream releases, and opens/commits vendored-plugin updates authenticated as the ohmyzsh[bot] GitHub App. — [.github/workflows/dependencies/updater.py](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/.github/workflows/dependencies/updater.py) [.github/dependencies.yml](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/.github/dependencies.yml) [.github/workflows/dependencies.yml](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/.github/workflows/dependencies.yml) - project.yml uses pull_request_target with an empty default permission set plus a GitHub App token to add new issues/PRs to the ohmyzsh org Project board and set Plugin/Theme fields. — [.github/workflows/project.yml](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/.github/workflows/project.yml) - CONTRIBUTING.md mandates Conventional Commits (type(scope)!: subject) because tools/changelog.sh generates the user-facing changelog from commit subjects — so commit-message discipline is itself part of the test/release pipeline. — [CONTRIBUTING.md#L172-241](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/CONTRIBUTING.md#L172-L241) [tools/changelog.sh](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/tools/changelog.sh) - No test covers oh-my-zsh.sh init order, compfix/compinit handling, upgrade.sh, check_for_upgrade.sh, or lib/git.zsh prompt parsing — the riskiest shell logic is verified only by the syntax sweep. (inferred) — [.github/workflows/main.yml#L35-43](https://github.com/ohmyzsh/ohmyzsh/blob/86ef6555e068663736a33376e4055aca9c1acc89/.github/workflows/main.yml#L35-L43) Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers. ## Public product links - [CodeVetter](https://codevetter.com/) - [Download](https://codevetter.com/download) - [Documentation](https://codevetter.com/docs/) - [Source](https://github.com/Codevetter/codevetter)