refactor: enforce frontend view model boundaries

scripts/check-image-publication.cjs

@@ -14,14 +14,20 @@ const { spawnSync } = require("node:child_process");
 
 test("immutable publication resumes exact digest checks after post-push failure", () => {
 	const directory = mkdtempSync(nodePath.join(tmpdir(), "wl-image-retry-"));
+
 	const workflow = readFileSync(
 		nodePath.resolve(__dirname, "../.gitea/workflows/image.yml"),
 		"utf8",
 	);
+
 	const block = workflow
-		.split("      - name: Publish immutable release tag\n        run: |\n", 2)[1]
+		.split(
+			"      - name: Publish immutable release tag\n        run: |\n",
+			2,
+		)[1]
 		.split("      - name:", 1)[0]
 		.replaceAll(/^ {10}/gm, "");
+
 	const double = String.raw`#!${process.execPath}
 const fs = require('node:fs');
 const args = process.argv.slice(2).join(' ');
@@ -39,6 +45,7 @@ if (args.startsWith('manifest inspect')) {
   console.log(args.includes('image.version') ? '1.2.3' : process.env.BAD_REVISION ? 'other' : 'commit');
 } else if (args.startsWith('run') && process.env.BAD_SMOKE) process.exit(1);
 `;
+
 	try {
 		for (const name of ["docker", "npm"]) {
 			// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
@@ -46,6 +53,7 @@ if (args.startsWith('manifest inspect')) {
 			// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
 			chmodSync(nodePath.join(directory, name), EXECUTABLE_MODE);
 		}
+
 		const run = (extra = {}) =>
 			spawnSync("/bin/sh", ["-ec", block], {
 				cwd: directory,
@@ -59,6 +67,7 @@ if (args.startsWith('manifest inspect')) {
 					...extra,
 				},
 			});
+
 		assert.notEqual(run().status, 0);
 		const retry = run();
 		assert.equal(retry.status, 0, retry.stdout + retry.stderr);