[Tests] run every test file: exec bits, fixes; add check-exec to CI

urchin only executes test files that have the executable bit, silently skipping the rest,
and `npm run test:check-exec` would catch non-executable ones, but no workflow ran it -
so seven test files have never actually run.
Make all of them executable, and fix the ones that were broken and verifiable locally:
- `nvm install --offline` (born 644 in 59bd32b): `nvm ls | tail -1` always grabbed an alias line, never a version;
use `nvm_ls` and skip its trailing `system <version>` line.
- `nvm exec ... help should not parse`: in a BRE, `[options]` is a bracket expression,
so the grep could never match node's literal `Usage: node [options]` output.
- `nvm use ... nvmrc containing not installed version`: current output once again matches its expectations verbatim; no changes needed.
The io.js source-install tests and the sudo-dependent uninstall-permissions test
can only be exercised in CI; if they fail there, they fail visibly, which beats silent skipping.

Rewrite `test:check-exec` in POSIX sh - npm runs scripts with /bin/sh, which is dash on Ubuntu,
where the previous `[[`/`$'\n'` bashisms would break -
and match by extension, so that filenames containing dots (like `.nvmrc from source`) can not dodge the check.
Then wire it into the lint workflow.

Author: ljharb

.github/workflows/lint.yml

@@ -71,11 +71,29 @@ jobs:
       - name: check tests filenames
         run: ./rename_test.sh --check
 
+  check_exec:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: step-security/harden-runner@v2
+        with:
+          allowed-endpoints:
+            github.com:443
+            raw.githubusercontent.com:443
+            nodejs.org:443
+            registry.npmjs.org:443
+      - uses: actions/checkout@v6
+      - uses: ljharb/actions/node/install@main
+        name: 'nvm install lts/* && npm install'
+        with:
+          node-version: 'lts/*'
+      - name: check that test files are executable
+        run: npm run test:check-exec
+
   all:
     permissions:
       contents: none
     name: 'all linting'
-    needs: [eclint, dockerfile_lint, doctoc, test_naming]
+    needs: [eclint, dockerfile_lint, doctoc, test_naming, check_exec]
     runs-on: ubuntu-latest
     steps:
       - run: true

package.json

@@ -14,7 +14,7 @@
     "test/installation/node": "shell=$(basename -- $(ps -o comm= $(ps -o ppid= -p $PPID)) | sed 's/^-//'); make TEST_SUITE=installation_node test-$shell",
     "test/installation/iojs": "shell=$(basename -- $(ps -o comm= $(ps -o ppid= -p $PPID)) | sed 's/^-//'); make TEST_SUITE=installation_iojs test-$shell",
     "test/sourcing": "shell=$(basename -- $(ps -o comm= $(ps -o ppid= -p $PPID)) | sed 's/^-//'); make TEST_SUITE=sourcing test-$shell",
-    "test:check-exec": "(IFS=$'\\n'; for file in $(git ls-files test); do if [ ! -x \"$file\" ] && [[ \"$file\" != *.* ]] && [[ \"$file\" != test/fixtures/* ]]; then echo \"$file\"; fi; done) | tee /dev/stderr | awk 'END {if (NR > 0) exit 1}'",
+    "test:check-exec": "git ls-files test | while IFS= read -r file; do if [ ! -x \"$file\" ]; then case \"$file\" in test/fixtures/*|*.json|*.txt|*.sh|*.js|*.log|*.tab|*.gitkeep) ;; *) echo \"$file\" ;; esac; fi; done | tee /dev/stderr | awk 'END {if (NR > 0) exit 1}'",
     "test:check-nonexec": "(IFS=$'\\n'; for file in $(git ls-files test); do if [ -x \"$file\" ] && [ ! -d \"$file\" ] && { [[ \"$file\" =~ '\\.(json|txt|sh|js|log)$' ]] || [[ \"$file\" =~ '^test/(mocks|fixtures)/.*' ]]; }; then echo \"$file\"; fi; done) | tee /dev/stderr | awk 'END {if (NR > 0) exit 1}'",
     "doctoc": "doctoc --title='## Table of Contents' --github README.md",
     "predoctoc:check": "cp README.md v-README.md.orig && npm run doctoc",

test/fast/Unit tests/nvm install --offline

@@ -12,8 +12,10 @@ nvm_download() {
 }
 
 # --offline with an already-installed version should succeed
-INSTALLED_VERSION="$(nvm ls | command tail -1 | command awk '{print $1}' | command sed 's/\x1b\[[0-9;]*m//g')"
-if [ -n "${INSTALLED_VERSION}" ] && [ "_${INSTALLED_VERSION}" != '_N/A' ] && [ "_${INSTALLED_VERSION}" != '_system' ]; then
+# (`nvm ls` ends with the alias listing, so use `nvm_ls`, which emits bare
+# versions, and skip its trailing `system <version>` line)
+INSTALLED_VERSION="$(nvm_ls | command grep -v '^system' | command tail -n1)"
+if [ -n "${INSTALLED_VERSION}" ] && [ "_${INSTALLED_VERSION}" != '_N/A' ]; then
   try nvm install --offline "${INSTALLED_VERSION}"
   [ "_$CAPTURED_EXIT_CODE" = "_0" ] \
     || die "nvm install --offline with installed version '${INSTALLED_VERSION}' should succeed, got exit code $CAPTURED_EXIT_CODE"

test/fast/Unit tests/nvm_offline_version

@@ -6,4 +6,6 @@ die () { echo "$@" ; exit 1; }
 
 nvm use 0.10
 
-nvm exec stable -- node --help | grep 'Usage: node [options]' || die "Help menu should have been displayed for node and not nvm"
+# note: in a BRE, `[options]` is a bracket expression, so the literal `[options]`
+# in node's help output could never match; match the unbracketed prefix instead
+nvm exec stable -- node --help | grep 'Usage: node' || die "Help menu should have been displayed for node and not nvm"