From 95dd90a2462a087340402c5a0f09210ecce7a50e Mon Sep 17 00:00:00 2001
From: quality <280983584+hivecommons-hive[bot]@users.noreply.github.com>
Date: Fri, 30 Oct 2026 06:44:56 -0400
Subject: [PATCH] =?UTF-8?q?=F0=9F=8C=B1=20test:=20assert=20the=20unscoped?=
 =?UTF-8?q?=20unused-exception=20path=20of=20the=20npm=20audit=20gate?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#526 taught the gate to key exceptions by GHSA and package, and to print the
package (or * for an unscoped entry) in the unused-exception warning. Only the
scoped form of that warning was asserted, so the * fallback and the
scoped-entry-wins-wildcard-is-unused rule could both regress unnoticed.

Signed-off-by: quality <280983584+hivecommons-hive[bot]@users.noreply.github.com>
---
 scripts/npm-audit-gate.test.ts | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/scripts/npm-audit-gate.test.ts b/scripts/npm-audit-gate.test.ts
index 61d96a37..1751764b 100644
--- a/scripts/npm-audit-gate.test.ts
+++ b/scripts/npm-audit-gate.test.ts
@@ -245,6 +245,19 @@ describe("evaluateAudit", () => {
     expect(r.unused).toEqual([]);
   });
 
+  it("reports an unscoped exception as unused when a scoped one already covers the only package", () => {
+    // The scoped entry wins the match, so the wildcard is redundant and must
+    // be flagged rather than silently counted as used by the same advisory.
+    const r = evaluateAudit(
+      REPORT,
+      [exception({ package: "braces" }), exception({ package: undefined })],
+      "high",
+      NOW
+    );
+    expect(r.excepted.map(a => a.package)).toEqual(["braces"]);
+    expect(r.unused).toEqual([exception({ package: undefined })]);
+  });
+
   it.each(["moderate", "high"])(
     "keeps the second package blocking with a %s first package and scoped exception",
     severity => {
@@ -429,6 +442,19 @@ describe("main", () => {
     expect(out).toMatch(/passed at level "high"/);
   });
 
+  it("prints an unused unscoped exception with a * package marker", () => {
+    const report = write("audit.json", REPORT);
+    write(".github/npm-audit-exceptions.json", [
+      exception(),
+      exception({ id: "GHSA-zzzz-zzzz-zzzz", package: undefined }),
+    ]);
+    main([report, "--level=high"]);
+    expect(exitSpy).not.toHaveBeenCalled();
+    expect(logSpy.mock.calls.flat().join("\n")).toMatch(
+      /::warning::Unused npm audit exception GHSA-zzzz-zzzz-zzzz \(\*\) — remove it\./
+    );
+  });
+
   it("omits the Ignoring line when nothing sits below the level", () => {
     const report = write("audit.json", REPORT);
     write(".github/npm-audit-exceptions.json", [