fix(ci): repair CI (lockfile, CVE overrides, SPDX headers)

.license-checker.allow

@@ -0,0 +1,15 @@
+# SPDX license ids allowed for production dependencies (one per line).
+# Consumed by license-checker --onlyAllow in .github/workflows/license.yml.
+# Blank lines and # comments are ignored. Add ids as new prod deps appear.
+MIT
+ISC
+Apache-2.0
+BSD-2-Clause
+BSD-3-Clause
+0BSD
+Unlicense
+CC0-1.0
+CC-BY-4.0
+BlueOak-1.0.0
+MIT-0
+Python-2.0

bin/pure-test.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
 
 /**
  * pure-test CLI - discovers and runs test files.

pnpm-workspace.yaml

@@ -5,6 +5,10 @@
 "allowBuilds":
   "sharp": true
   "workerd": true
+"overrides":
+  "ws": "^8.21.0"
+  "undici": "^7.28.0"
+  "brace-expansion": "^5.0.6"
 "autoInstallPeers": false
 "lockfileIncludeTarballUrl": true
 "preferFrozenLockfile": true

scripts/build.mjs

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 /**
  * build.mjs - Clean build with comment stripping.
  *

scripts/coverage-all.mjs

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 /**
  * coverage-all.mjs - Per-runtime coverage orchestrator.
  *

scripts/license-headers.mjs

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 // license-headers.mjs - Verify and optionally fix SPDX license headers.
 //
 // Usage:

scripts/prepublish.mjs

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 /**
  * prepublish.mjs - Pre-publish gate.
  *

scripts/test-ci.mjs

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 /**
  * test-ci.mjs - Run the full CI test matrix locally.
  *

scripts/test-matrix.mjs

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 /**
  * test-matrix.mjs - Run full test suite across all available runtimes.
  * Used inside Docker containers and natively on macOS.

tests/browser-test.mjs

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 /**
  * Browser smoke test via Playwright.
  *

tests/cli.test.mjs

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 /**
  * CLI integration tests: spawn bin/pure-test.mjs and assert on exit codes / output.
  *

tests/deno-adapter.test.mjs

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 /**
  * Deno adapter smoke test.
  *

tests/fixtures/example.test.mjs

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 import { describe, expect, it } from "../../dist/index.js";
 
 describe("example", () => {

tests/grep-test.mjs

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 /**
  * Tests for setGrep / --grep filtering.
  *

tests/only-test.mjs

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 /**
  * Tests for it.only and describe.only.
  *

tests/self-test.mjs

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 /**
  * Self-test: the test runner testing itself.
  *

tests/ts-cli.test.mjs

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 /**
  * TypeScript CLI integration tests (Node-only).
  *

tests/ts/sample.test.ts

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 import { describe, expect, it } from "../../dist/index.js";
 
 interface Point {

tests/worker-test.mjs

@@ -1,3 +1,5 @@
+// Copyright 2026 igorjs. SPDX-License-Identifier: Apache-2.0
+
 /**
  * Cloudflare Workers smoke test via Miniflare API.
  *