gstack/test/osv-config-wiring.test.ts

/**
 * OSV scanner config wiring (#2679-wave / v1.78.0.0).
 *
 * The suppression file was inert from v1.65.0.0 to v1.78.0.0: OSV-Scanner
 * only auto-discovers configs named `osv-scanner.toml` (no leading dot) and
 * applies them PER-DIRECTORY — a repo-root config never covers
 * lib/diagram-render/bun.lock. The workflow must therefore pass an explicit
 * global `--config` naming the file that actually exists. These tests pin
 * that three-way agreement (workflow flag ↔ file on disk ↔ entry hygiene) so
 * the filename and the flag can never drift apart silently again.
 */
import { describe, expect, test } from "bun:test";
import * as fs from "node:fs";
import * as path from "node:path";

const ROOT = path.resolve(import.meta.dir, "..");
const WORKFLOW = path.join(ROOT, ".github", "workflows", "osv-scanner.yml");
const CONFIG = path.join(ROOT, ".osv-scanner.toml");

describe("osv-scanner config wiring", () => {
  test("workflow passes an explicit --config (auto-discovery never covers nested lockfiles)", () => {
    const wf = fs.readFileSync(WORKFLOW, "utf-8");
    const m = wf.match(/--config=(\S+)/);
    expect(m).not.toBeNull();
    // The flag must name a file that exists at repo root.
    expect(fs.existsSync(path.join(ROOT, m![1]))).toBe(true);
  });

  test("every IgnoredVulns entry has id, reason, and an ignoreUntil expiry", () => {
    const cfg = fs.readFileSync(CONFIG, "utf-8");
    const entries = cfg.split("[[IgnoredVulns]]").slice(1);
    expect(entries.length).toBeGreaterThan(0);
    for (const entry of entries) {
      expect(entry).toMatch(/^id = "GHSA-/m);
      expect(entry).toMatch(/^reason = ".{20,}/m);
      // Suppressions must expire — a permanent exception is a silent hole.
      expect(entry).toMatch(/^ignoreUntil = \d{4}-\d{2}-\d{2}/m);
    }
  });

  test("ignoreUntil dates are TOML datetimes the scanner can parse (not strings)", () => {
    const cfg = fs.readFileSync(CONFIG, "utf-8");
    // TOML datetime is unquoted; a quoted date silently parses as a string
    // and (depending on scanner version) may be ignored.
    expect(cfg).not.toMatch(/ignoreUntil = "/);
  });
  test("the braces ignore stays true: the shipped diagram-render page carries no chokidar/braces code", () => {
    const toml = fs.readFileSync(path.join(ROOT, ".osv-scanner.toml"), "utf8");
    if (!toml.includes('id = "GHSA-vfj7-8cjw-p6xm"')) return;
    const page = fs.readFileSync(path.join(ROOT, "lib", "diagram-render", "dist", "diagram-render.html"), "utf8");
    expect(page).not.toMatch(/chokidar|FSWatcher/);
  });

  test("the chokidar override keeps braces (GHSA-vfj7-8cjw-p6xm, no fixed release) out of lib/diagram-render", () => {
    const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, "lib", "diagram-render", "package.json"), "utf8"));
    expect(pkg.overrides.chokidar).toMatch(/^4\./);
    const lock = fs.readFileSync(path.join(ROOT, "lib", "diagram-render", "bun.lock"), "utf8");
    expect(lock).toMatch(/"chokidar": \["chokidar@4\.\d+\.\d+"/);
    expect(lock).not.toMatch(/"braces": \["braces@/);
  });
});