Make --forbid-only (but not --forbid-pending) default in CI

[ScottFreeCode]

Eventually let's make --forbid-only the default and use --no-forbid-only to disable it. Lots of CI will get safer for free!

(Pending, on the other hand, isn't so dangerous to begin with and has more long-term use-cases. It'll be inconsistent, but let's leave pending as-is.)

[boneskull]

Actually, this is fine if we make --forbid-only the default if the CI environment var is present.

[parksb]

I agree with making --forbid-only the default on CI environment. Can I take this issue?

[outsideris]

@parksb Yes, you can.

[github-actions]

This issue hasn't had any recent activity, and I'm labeling it stale. Remove the label or comment or this issue will be closed in 14 days. Thanks for contributing to Mocha!

[github-actions]

This issue hasn't had any recent activity, and I'm labeling it stale. Remove the label or comment or this issue will be closed in 14 days. Thanks for contributing to Mocha!

[JoshuaKGoldberg]

I'm in favor of this as a changed default for CI environments. It's better to have safety be opt-in IMO. This is what Vitest does and it's quite useful.

[JoshuaKGoldberg]

Forbidding .only in CI is a good safe practice that other test frameworks do in CI (e.g. https://vitest.dev/config/#allowonly). Marking as accepting PRs for Mocha.

Note that it'd be a breaking change, so we wouldn't be able to merge for a while.