UI5 / cli / 19897914723

95%

push

github

refactor(shrinkwrap-extractor): Refactor test fixtures (#1226)

The `shrinkwrap-extractor` tests use real `package-lock.json` samples as
fixtures. GitHub Dependabot scans all `package-lock.json` files in the
repository and reports vulnerabilities, even though these are:
- Test-only data files (never installed or executed)
- Part of a private package (`shrinkwrap-extractor`)
- Parsed virtually by `@npmcli/arborist.loadVirtual()` without
installing packages

This creates false-positive security alerts at
https://github.com/UI5/cli/security/dependabot.

The solution is to rename test fixtures from `package-lock.json` to
`package-lock.fixture.json` so Dependabot ignores them.

Since `@npmcli/arborist.loadVirtual()` requires a file named exactly
`package-lock.json`, we create temporary symlinks during test execution.
Symlinks are automatically cleaned up after each test.

5066 of 5519 branches covered (91.79%)

Branch coverage included in aggregate %.

9379 of 9736 relevant lines covered (96.33%)

4744.61 hits per line