[github-actions]

WHY are these changes introduced?

The seven-day review of Main tests (2026-10-14T00:23Z–2026-10-21T00:23Z UTC) found four failed runs on main, all windows-latest, and both distinct failures already have open fixes:

• app-security-commands.test.ts > the PowerShell record command reads a findings file without a byte order mark as UTF-8 in Windows PowerShell 5.1 timed out at 13000ms in all four runs (39241753364, 38773610537, 38766274961, 38709303616) — covered by [Tests] Give the PowerShell record test room for powershell.exe startup #8832.
• secret-safety.test.ts > does not score a 32-hex value under a secret-sounding name, quoted or not timed out in 38766274961 — covered by [Tests] Split the 32-hex secret test into one test per assignment form #8928.

No run in the window had an earlier failed attempt, and no other test crossed its timeout, so there is no remaining actionable flake to fix. This PR takes the coverage fallback instead.

channel_config is the only extension specification that declares a pattern inclusion with both a baseDir and a destination, and it has no test. Its clientSteps entry decides exactly which files reach the deploy bundle and where they land, but nothing asserts that: the integration test for createContractBasedModuleSpecification only checks that an arbitrary clientSteps value is passed through, and include-assets-step.test.ts covers the step mechanics with its own inline configs rather than this specification's.

WHAT is this pull request doing?

Adds channel.test.ts, which runs the specification's real deploy step over a real temporary extension directory and asserts the resulting bundle:

• every declared format (json, toml, yaml, yml, svg) is bundled, including from a nested subdirectory, and lands under specifications/
• files the contract does not cover are left out — other formats in specifications/, and spec-format files outside it

The test reads the step from loadLocalExtensionsSpecifications() rather than restating the config, so it tracks the specification instead of duplicating it, and it asserts bundle contents rather than the shape of the declaration. No production code changes.

Validation: both tests pass locally on Linux Node 26.1.0, alongside all 32 extension-model test files (415 passed), five times under --sequence.shuffle together with include-assets-step.test.ts, which shares the step they both drive, and under --pool=forks and --no-file-parallelism. nx type-check app and ESLint on the new file both pass. I confirmed each test fails without the behavior it covers by temporarily mutating the specification three ways: dropping svg from the formats and dropping destination each fail the first test, and widening include to **/* fails the second.

Remaining uncertainty: the tests are filesystem-only with no subprocess or network, so they should behave the same on Windows and macOS, but I ran them only on Linux.

How to manually test your changes?

shopify app import channel-config
shopify app deploy

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add