refactor(ci): port source and test report checks to TypeScript

[kmbroai]

Summary

Replace the portable-source checker and JUnit inventory comparator with typed TypeScript utilities. Compile them with the existing TypeScript compiler and run the emitted JavaScript on Node 22.13.0, removing these utilities' Python dependency without experimental type stripping.

Changes

• Replace the two Python utilities and source-checker test with three typed .mts files while preserving source limits, Markdown checks, tracked-file handling, JUnit outcomes, duplicate detection, and shard comparison.
• Add build:ci to emit adjacent ignored .mjs files. Compile before running the utilities in CI and update contributor commands, regression tests, and development dependencies.
• Give parameterized cost, budget, release, and matching tests unique JUnit identities. The four boolean-title corrections inherited from current main are in sdk/typescript/tests-ts/finding-catalogue.test.ts, sdk/typescript/tests-ts/cli-workbench.test.ts, and sdk/typescript/tests-ts/cli.test.ts. Only their %s title placeholders change to %p; fixtures, assertions, comparator behavior, and product code are unchanged.

Testing

• Frozen SDK and MCP dependency installation, CI-tool compilation, plugin build, and formatting of the three corrected test files passed.
• On Bun 1.3.13, all eight affected boolean cases passed with 50 assertions in each of baseline, isolated, and parallel modes. Each JUnit report has 229 unique identities, including the 221 filtered cases, and records distinct false and true identities for all four corrected pairs.
• The unchanged comparator accepted both focused mode comparisons.
• Replayed all 13 existing hosted runner reports using only the four known title corrections. Outcomes and test counts were preserved, no additional duplicate groups were found, and all five inventory comparisons passed, including the combined seven Windows shards. This projection verifies the naming correction; fresh hosted execution must still validate the revised head.
• The five existing commits were rebased onto current main without patch changes, verified by git range-diff.

Risk and rollout

The affected CI jobs install SDK development dependencies and compile the utilities before running them. Generated JavaScript is ignored and excluded from the published SDK. Test fixtures compile isolated copies so parallel runs do not share generated files. The comparator continues to reject duplicate identities; corrected titles expose existing parameter values without changing test behavior.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-04T23:34:14.481540Z	0fe1165	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

TypeScript compilation, the source checker tests, and the report/workflow regression tests passed locally. No actionable findings in the port.

The current inventory-comparison failure reproduces with the original Python comparator on the same report and comes from duplicate test names already on main.

[mldangelo-oai]

The port remains behaviorally sound. These two non-blocking simplifications remove custom filesystem/build plumbing and keep the checks closer to native Node and shell behavior.