typescript-ci-zod-email-validation

Answer

Root cause. POST /api/memories resolves the author email via git config user.email and falls back to a hardcoded constant when git is unavailable. GH Actions runners have no user.email configured, so the fallback path is always taken on CI. The fallback duckbrain@localhost fails z.string().email() because Zod's email regex requires a dot in the domain (no bare-TLD localhost allowed). The validation failure surfaces as a 500 instead of 201. Locally it passed because the dev machine has user.email set, so the fallback never executed.

The fix — change the fallback constant to a Zod-valid address (localhost.localdomain is a valid FQDN; the domain contains the required dot):

// author-email.ts (or wherever the fallback lives)
const FALLBACK_AUTHOR_EMAIL = '<email>'; // was 'duckbrain@localhost'

export function resolveAuthorEmail(): string {
  try {
    const email = execFileSync('git', ['config', 'user.email'], { encoding: 'utf8' }).trim();
    if (email) return email;
  } catch {
    // git unavailable / not configured (GH Actions runners) -> fall through
  }
  return FALLBACK_AUTHOR_EMAIL;
}

The handler needs no change — a valid email now passes RememberMemorySchema.safeParse and returns 201:

// POST /api/memories handler (unchanged)
const authorEmail = resolveAuthorEmail();
const parsed = RememberMemorySchema.safeParse({ content, authorEmail });
if (!parsed.success) return res.status(500).json({ error: 'validation_failed', issues: parsed.error.issues });
return res.status(201).json({ id: insertMemory(parsed.data) });

Regression test mocking the git-unavailable environment (the exact CI condition that was untested):

// author-email.regression.test.ts
import { afterEach, describe, expect, it, vi } from 'vitest';
import { resolveAuthorEmail } from './author-email';

describe('resolveAuthorEmail fallback (CI-only regression)', () => {
  it('returns a Zod-valid fallback when git is unavailable', () => {
    // git exits 128 / throws on runners -> fallback path
    vi.spyOn(require('child_process'), 'execFileSync').mockImplementation(() => {
      throw new Error('git: user.email not configured');
    });
    const email = resolveAuthorEmail();
    expect(RememberMemorySchema.safeParse({ content: 'x', authorEmail: email }).success).toBe(true);
    expect(email).toBe('<email>');
  });

  it('prefers a configured git user.email when present (local dev)', () => {
    vi.spyOn(require('child_process'), 'execFileSync').mockReturnValue('<email>');
    expect(resolveAuthorEmail()).toBe('<email>');
  });

  afterEach(() => vi.restoreAllMocks());
});