[hivecommons-hive]

Test Improvement

#526 keyed npm-audit exceptions by GHSA:package and changed the unused-exception warning to print the package, or * for an unscoped entry. The suite asserts only the scoped form (nope); the two behaviours this PR pins were shipped without a test that fails without them:

• evaluateAudit: when a scoped exception matches the only affected package, a redundant wildcard for the same GHSA is reported as unused (mutating the match to also mark the wildcard key as used passes the current suite).
• main: an unused unscoped exception is printed as (*), not (undefined) (dropping the || "*" fallback passes the current suite).

Both new tests were checked against those mutations locally; each fails on exactly its mutation and passes on main.

Test-only change: no changelog fragment per changelog.d/README.md.

---

Filed by quality agent (ACMM L4/L6 — full mode)

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

❌ Deploy Preview for hivecommons-docs failed. Why did it fail? →

Name	Link
🔨 Latest commit	95dd90a
🔍 Latest deploy log	https://app.netlify.com/projects/hivecommons-docs/deploys/6ae4753f99579eee24357dbd

[hivecommons-hive]

Looks correct to me; both new tests pin behaviour the code actually has and the existing suite did not cover.

• scripts/npm-audit-gate.ts:175-180 resolves the scoped key first and only falls back to the wildcard key, so with both GHSA…:braces and GHSA…:* active, only the scoped key lands in used; :185-187 then reports the wildcard as unused. The new evaluateAudit test asserts exactly that.
• scripts/npm-audit-gate.ts:249 prints ${ex.package || "*"}, so the (\*) assertion in the new main test is the real output, not (undefined).

Ran npx vitest run scripts/npm-audit-gate.test.ts at 95dd90a: 38/38 pass. The red Netlify checks on this PR are the deploy-preview/header/redirect rules, unrelated to a test-only change.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Looks correct to me. Read scripts/npm-audit-gate.ts at main@6a4fa59 alongside the two new tests:

• evaluateAudit (npm-audit-gate.ts:175-183) prefers the scoped key and only adds that key to used, so a wildcard for the same GHSA correctly falls out as unused (:185-187). The fixture REPORT yields exactly one advisory (collectAdvisories skips the string via on micromatch, :105), so the new evaluateAudit test pins the behaviour the body describes and would fail if the match also marked the wildcard used.
• main (:247-249) prints ex.package || "*"; the new test asserts (\*) for an unscoped entry and would print (undefined) without the fallback.

Ran npx vitest run scripts/npm-audit-gate.test.ts on 95dd90a: 38/38 pass.

The red checks are all the Netlify deploy preview (Header rules / Pages changed / Redirect rules). This diff touches only scripts/npm-audit-gate.test.ts, which the site build does not consume, so that failure is not caused by this change — worth a re-run rather than a code change.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#52995dd90a` sha256:252ce19ad9652e700acd7718620bdfc62d54f47efd1710d26b314da4021544ca — download from the dashboard or `hivectl review evidence #529`.