commandbox-testing — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited commandbox-testing (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
CommandBox has built-in integration with TestBox — the BDD/TDD testing framework for CFML/BoxLang. Run your test suite from the CLI and integrate with CI pipelines.
# See all testbox commands
testbox help/tests/runner.cfm)# Install TestBox
install testbox --saveDev
# Start your server
server start
# Run tests
testbox runtestbox run# Run with default runner URL from box.json
testbox run
# Specify runner URL explicitly
testbox run "http://localhost:8080/tests/runner.cfm"
# Use relative path (CommandBox resolves host/port from server)
testbox run "/tests/runner.cfm"
# Verbose output (default)
testbox run --verbose
# Minimal output
testbox run --noVerbose
# Run specific test bundles
testbox run bundles=tests.unit.MyTest
# Run with labels
testbox run labels=unit
testbox run labels=unit,integration
# Run specific suites
testbox run testSuites=MySuite
# Run specific specs
testbox run testSpecs=itShouldDoSomething
# Multiple output formats
testbox run outputformats=json,antjunit,simple
# Output formats to file
testbox run outputformats=json,antjunit outputFile=build/test-results
# Additional URL options
testbox run options:opt1=value1 options:opt2=value2Executing tests via http://127.0.0.1:8080/tests/runner.cfm...
TestBox v5.0.0
---------------------------------------------------------------------------
| Passed | Failed | Errored | Skipped | Time | Bundles | Suites | Specs |
---------------------------------------------------------------------------
| 42 | 0 | 0 | 2 | 320 ms | 3 | 8 | 44 |
---------------------------------------------------------------------------box.jsonSet the runner URL once so testbox run works without arguments:
# Set absolute URL
package set testbox.runner="http://localhost:8080/tests/runner.cfm"
# Set relative URL (auto-resolves from server settings)
package set testbox.runner="/tests/runner.cfm"
# Now just run
testbox runbox.json TestBox Configuration{
"testbox": {
"runner": "http://localhost:8080/tests/runner.cfm",
"verbose": false,
"labels": "unit,integration",
"testSuites": "MySuite",
"testSpecs": "",
"bundles": "",
"recurse": true,
"reporter": "json",
"outputformats": "json,antjunit",
"outputFile": "build/test-results",
"watchDelay": 1000,
"watchPaths": "/models/**.cfc,/handlers/**.cfc",
"options": {
"opt1": "value1"
}
}
}testbox watch monitors files and re-runs tests on any change:
# Setup requirement: runner configured in box.json
package set testbox.runner=http://localhost:8080/tests/runner.cfm
server start
# Watch all files
testbox watch
# Watch specific pattern
testbox watch **.cfc
testbox watch /models/**.cfc,/handlers/**.cfc
# Using box.json watchPaths
package set testbox.watchPaths=/models/**.cfc
testbox watchWatcher options in box.json:
package set testbox.watchDelay=500 # ms between checks (default: 1000)
package set testbox.verbose=false # reduce output
package set testbox.labels=unit # only run labeled tests
package set testbox.watchPaths=/models/**.cfcStop the watcher with Ctrl+C.
# .github/workflows/tests.yml
name: Tests
on: [push, pull_request]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup CommandBox
uses: Ortus-Solutions/[email protected]
- name: Install Dependencies
run: box install
- name: Start Server
run: box server start --noOpenBrowser
- name: Run Tests
run: box testbox run --noVerbose outputformats=antjunit outputFile=build/test-results
- name: Publish Test Results
uses: EnricoMi/publish-unit-test-result-action@v2
if: always()
with:
files: "build/test-results*.xml"| Format | Description | File Extension |
|---|---|---|
simple | Text summary (default CLI output) | .txt |
json | Full JSON test report | .json |
antjunit | JUnit-compatible XML (for CI tools) | .xml |
mintext | Minimal text output | .txt |
dot | Dot-notation summary | .txt |
# Generate all formats
testbox run outputformats=json,antjunit,simple outputFile=build/results
# Files created: build/results.json, build/results.xml, build/results.txtWhen running on a server with FusionReactor installed and TestBox 2.9+:
# Code coverage appears automatically in the output
testbox run
# Output includes:
# Code Coverage: 73% (450 LOC tracked)# test-and-start.boxr
install
server start
testbox run || exit 1recipe test-and-start.boxrbox.json scripts{
"scripts": {
"test": "testbox run",
"test:watch": "testbox watch",
"prePublish": "testbox run"
}
}run-script test
run-script test:watch// task.cfc
component {
function test() {
var exitCode = command( "testbox run" )
.params( verbose=false )
.run( returnExitCode=true );
if ( exitCode != 0 ) {
error( "Tests failed! Aborting build." );
}
print.greenLine( "All tests passed!" );
}
}task run test~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.