[Chore] Require changed-code mutation tests before review (#1479)

* feat(ci): add changed-code mutation gate

* feat(ci): expand mutation gate coverage

* test(ci): run Stryker integration smoke

* test(ci): remove Stryker smoke fixture

---------

Co-authored-by: Roomote <roomote@roomote.dev>

Author: zoomote[bot]

.github/workflows/mutation-testing.yml

@@ -0,0 +1,68 @@
+name: Changed-code mutation testing
+
+on:
+    pull_request:
+        types: [edited, opened, reopened, ready_for_review, synchronize]
+    merge_group:
+        types: [checks_requested]
+
+permissions:
+    contents: read
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+    cancel-in-progress: true
+
+jobs:
+    mutation-diff:
+        name: mutation-diff
+        runs-on: ubuntu-latest
+        timeout-minutes: 30
+        steps:
+            - name: Record merge-queue enforcement
+              if: github.event_name == 'merge_group'
+              run: |
+                  echo "## Changed-code mutation testing" >> "$GITHUB_STEP_SUMMARY"
+                  echo "Mutation testing was enforced on each pull request before it entered the merge queue." >> "$GITHUB_STEP_SUMMARY"
+
+            - name: Checkout pull request head
+              if: github.event_name == 'pull_request'
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              with:
+                  repository: ${{ github.event.pull_request.head.repo.full_name }}
+                  ref: ${{ github.event.pull_request.head.sha }}
+                  fetch-depth: 0
+                  persist-credentials: false
+
+            - name: Fetch pull request base
+              if: github.event_name == 'pull_request'
+              env:
+                  BASE_REPOSITORY_URL: ${{ github.server_url }}/${{ github.repository }}.git
+                  BASE_SHA: ${{ github.event.pull_request.base.sha }}
+              run: git fetch --no-tags "$BASE_REPOSITORY_URL" "$BASE_SHA"
+
+            - name: Setup Node.js and pnpm
+              if: github.event_name == 'pull_request'
+              uses: ./.github/actions/setup-node-pnpm
+              with:
+                  install-args: "--frozen-lockfile"
+
+            - name: Test mutation gate logic
+              if: github.event_name == 'pull_request'
+              run: pnpm test:mutation-ci
+
+            - name: Mutate changed executable lines
+              if: github.event_name == 'pull_request'
+              env:
+                  BASE_SHA: ${{ github.event.pull_request.base.sha }}
+                  HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+              run: node scripts/stryker-diff.mjs ci --base "$BASE_SHA" --head "$HEAD_SHA"
+
+            - name: Upload mutation reports
+              if: always() && github.event_name == 'pull_request'
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              with:
+                  name: changed-code-mutation-report
+                  path: reports/mutation/
+                  if-no-files-found: ignore
+                  retention-days: 7

.gitignore

@@ -5,6 +5,8 @@ out-*
 node_modules
 package-lock.json
 coverage/
+reports/mutation/
+.stryker-tmp/
 mock/
 
 .DS_Store

package.json

@@ -12,6 +12,7 @@
 		"lint": "turbo lint --log-order grouped --output-logs new-only",
 		"check-types": "turbo check-types --log-order grouped --output-logs new-only",
 		"test": "turbo test --log-order grouped --output-logs new-only",
+		"test:mutation-ci": "node --test scripts/stryker-diff.test.mjs",
 		"lifecycle:model-check": "tsx scripts/check-task-lifecycle.ts && tsx scripts/check-task-store-concurrency.ts",
 		"test:coverage": "turbo test:coverage --log-order grouped --output-logs new-only",
 		"format": "turbo format --log-order grouped --output-logs new-only",
@@ -28,6 +29,8 @@
 	"devDependencies": {
 		"@changesets/cli": "2.31.0",
 		"@roo-code/config-typescript": "workspace:^",
+		"@stryker-mutator/core": "10.0.0",
+		"@stryker-mutator/vitest-runner": "10.0.0",
 		"@types/node": "22.20.1",
 		"@vscode/vsce": "3.9.2",
 		"esbuild": "0.28.1",
@@ -60,6 +63,7 @@
 			"form-data": ">=4.0.4",
 			"bluebird": ">=3.7.2",
 			"glob": "11.1.0",
+			"qs": "6.15.2",
 			"@types/react": "18.3.31",
 			"@types/react-dom": "18.3.7",
 			"csstype": "3.2.3",