# Testing signals — pnpm/pnpm

> Canonical page: https://codevetter.com/unpack/pnpm/testing-signals

# Testing signals — pnpm/pnpm

Scanned commit b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Tests and CI definitions were inspected, not executed; no passing result, measured coverage percentage, or benchmark outcome is established here. Rust uses ordinary and Tokio tests, process-level CLI fixtures, snapshots, and cargo-nextest configuration. TypeScript uses Jest with registry-backed project fixtures. The inspected checks span installation, filtering, integrity, recovery, and language/runtime boundaries, but the bounded sample cannot establish all untested behavior.
- The inspected Rust CLI suite is assembled in tests/suite/main.rs as one integration-test binary, while nextest runs individual tests in separate processes; its modules include install-related commands, custom resolvers/fetchers, lifecycle behavior, and linker variants. — [pnpm/crates/cli/tests/suite/main.rs#L1-75](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/cli/tests/suite/main.rs#L1-L75)
- should_install_dependencies spawns the real CLI against a mocked registry, asserts the direct dependency is a symlink/junction, checks transitive placement in the virtual store, and snapshots workspace/store structure using insta. — [pnpm/crates/cli/tests/suite/install.rs#L5-14](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/cli/tests/suite/install.rs#L5-L14) [pnpm/crates/cli/tests/suite/install.rs#L60-102](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm/crates/cli/tests/suite/install.rs#L60-L102)
- TypeScript install/only.ts uses Jest and execPnpm fixtures to check production/development filtering; its production test also checks progress counts and verifies the resolved dev-transitive version in the lockfile before store-presence assertions. — [pnpm11/pnpm/test/install/only.ts#L5-46](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm11/pnpm/test/install/only.ts#L5-L46) [pnpm11/pnpm/test/install/only.ts#L58-95](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpm11/pnpm/test/install/only.ts#L58-L95)
- pnpr tarball tests use Tokio, mockito, temporary storage, and Axum oneshot requests to check declaring-version integrity binding and cache replay after router reconstruction; the same file includes a tampered-stream rejection test. — [pnpr/crates/pnpr/tests/server/tarball_verification.rs#L7-18](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/pnpr/tests/server/tarball_verification.rs#L7-L18) [pnpr/crates/pnpr/tests/server/tarball_verification.rs#L96-137](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/pnpr/tests/server/tarball_verification.rs#L96-L137)
- Journal-recovery tests fabricate interrupted on-disk publication state, including an older manifest format, to exercise sealed roll-forward and unsealed rollback; these recovery scenarios were read, not run. — [pnpr/crates/pnpr/tests/journal_recovery.rs#L1-4](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/pnpr/tests/journal_recovery.rs#L1-L4) [pnpr/crates/pnpr/tests/journal_recovery.rs#L76-85](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/pnpr/crates/pnpr/tests/journal_recovery.rs#L76-L85)
- The nextest smoke profile selects one test per behavior area and explicitly does not prove change correctness. Default tests receive a 60-second slow interval with termination after five intervals, and separate validation is documented for stale smoke-test names. — [.config/nextest.toml#L3-30](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/.config/nextest.toml#L3-L30) [.config/nextest.toml#L30-53](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/.config/nextest.toml#L30-L53)
- Rust CI invokes separate rust-test and pnpr-test pipelines and adds a Linux Node test of the built NAPI addon. TypeScript CI builds the bundle before sharded tests across Node 22.13, 24, and 26.10 on Linux, with a separate Windows shard matrix. — [.github/workflows/pacquet-ci.yml#L271-303](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/.github/workflows/pacquet-ci.yml#L271-L303) [.github/workflows/ci.yml#L112-124](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/.github/workflows/ci.yml#L112-L124) [.github/workflows/ci.yml#L152-205](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/.github/workflows/ci.yml#L152-L205)
- Ecosystem E2E and Cargo equivalence are scheduled compatibility checks rather than per-PR merge blockers; docs CI builds the external website with repository docs and checks URLs, while the inspected CodeQL matrix selects JavaScript. — [.github/workflows/ecosystem-e2e.yml#L3-22](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/.github/workflows/ecosystem-e2e.yml#L3-L22) [.github/workflows/cargo-equivalence.yml#L3-17](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/.github/workflows/cargo-equivalence.yml#L3-L17) [.github/workflows/docs.yml#L40-58](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/.github/workflows/docs.yml#L40-L58) [.github/workflows/codeql-analysis.yml#L39-57](https://github.com/pnpm/pnpm/blob/b2ef6cb63b8b7cb93d6b57f0d2efedf25d7c1385/.github/workflows/codeql-analysis.yml#L39-L57)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)