test_lockfiles.sh

#!/usr/bin/env bash

# Fixture tests for the lockfiles scan mode.
#
# A scanner that silently stops parsing a lockfile format still prints
# "No affected packages found." These tests fail loudly instead, and cover the
# npm, pnpm, and Yarn lockfile shapes that are actually in circulation.

set -u

SCRIPT_DIR=$(cd -- "$(dirname -- "$0")" && pwd -P)
INVENTORY_SCRIPT="$SCRIPT_DIR/package_inventory.js"

WORK_DIR=$(mktemp -d) || exit 2
trap 'rm -rf "$WORK_DIR"' EXIT HUP INT TERM

# A minimal package list, so the tests do not depend on the live IOC file.
CSV_FILE="$WORK_DIR/packages.csv"
cat >"$CSV_FILE" <<'EOF'
Package,Affected Versions
keyv,== 6.0.0
@cacheable/memory,== 2.2.1 || == 2.2.2
EOF

failures=0

# expect <name> <expected-output> <<< lockfile written by the caller into $case_dir
expect() {
	local name=$1 expected=$2 dir=$3 actual
	actual=$(node "$INVENTORY_SCRIPT" "$CSV_FILE" lockfiles "$dir" 2>&1)

	if [[ "$actual" == "$expected" ]]; then
		printf 'ok   %s\n' "$name"
	else
		printf 'FAIL %s\n     expected: %s\n     actual:   %s\n' \
			"$name" "${expected:-<none>}" "${actual:-<none>}"
		failures=$((failures + 1))
	fi
}

new_case() {
	local dir="$WORK_DIR/$1"
	mkdir -p "$dir"
	printf '%s' "$dir"
}

KEYV_HIT=$(printf 'keyv\t6.0.0')
SCOPED_HIT=$(printf '@cacheable/memory\t2.2.1')

# --- npm ------------------------------------------------------------------

dir=$(new_case npm-v3)
cat >"$dir/package-lock.json" <<'EOF'
{
  "lockfileVersion": 3,
  "packages": {
    "": { "name": "demo", "version": "1.0.0" },
    "node_modules/keyv": { "version": "6.0.0" },
    "node_modules/left-pad": { "version": "1.3.0" }
  }
}
EOF
expect "npm lockfileVersion 3" "$KEYV_HIT" "$dir"

dir=$(new_case npm-v1)
cat >"$dir/package-lock.json" <<'EOF'
{
  "lockfileVersion": 1,
  "dependencies": {
    "got": {
      "version": "11.8.6",
      "dependencies": { "keyv": { "version": "6.0.0" } }
    }
  }
}
EOF
expect "npm lockfileVersion 1 (nested)" "$KEYV_HIT" "$dir"

dir=$(new_case npm-shrinkwrap)
cat >"$dir/npm-shrinkwrap.json" <<'EOF'
{ "lockfileVersion": 3, "packages": { "node_modules/keyv": { "version": "6.0.0" } } }
EOF
expect "npm-shrinkwrap.json" "$KEYV_HIT" "$dir"

dir=$(new_case npm-scoped)
cat >"$dir/package-lock.json" <<'EOF'
{
  "lockfileVersion": 3,
  "packages": { "node_modules/@cacheable/memory": { "version": "2.2.1" } }
}
EOF
expect "npm scoped package" "$SCOPED_HIT" "$dir"

# --- pnpm -----------------------------------------------------------------

dir=$(new_case pnpm-v9)
cat >"$dir/pnpm-lock.yaml" <<'EOF'
lockfileVersion: '9.0'

packages:

  'keyv@6.0.0':
    resolution: {integrity: sha512-example}
  'left-pad@1.3.0':
    resolution: {integrity: sha512-example}
EOF
expect "pnpm lockfileVersion 9" "$KEYV_HIT" "$dir"

dir=$(new_case pnpm-v6)
cat >"$dir/pnpm-lock.yaml" <<'EOF'
lockfileVersion: '6.0'

packages:

  /keyv@6.0.0:
    resolution: {integrity: sha512-example}
EOF
expect "pnpm lockfileVersion 6 (leading slash)" "$KEYV_HIT" "$dir"

dir=$(new_case pnpm-v5)
cat >"$dir/pnpm-lock.yaml" <<'EOF'
lockfileVersion: 5.4

packages:

  /@cacheable/memory/2.2.1:
    resolution: {integrity: sha512-example}
EOF
expect "pnpm lockfileVersion 5 (slash-separated scoped)" "$SCOPED_HIT" "$dir"

dir=$(new_case pnpm-peer)
cat >"$dir/pnpm-lock.yaml" <<'EOF'
lockfileVersion: '9.0'

snapshots:

  'keyv@6.0.0(typescript@5.4.5)':
    dependencies: {}
EOF
expect "pnpm peer-suffixed descriptor" "$KEYV_HIT" "$dir"

# --- Yarn -----------------------------------------------------------------

dir=$(new_case yarn-classic)
cat >"$dir/yarn.lock" <<'EOF'
# THIS IS AN AUTOGENERATED FILE.

keyv@^6.0.0:
  version "6.0.0"
  resolved "https://registry.yarnpkg.com/keyv/-/keyv-6.0.0.tgz"
EOF
expect "yarn classic" "$KEYV_HIT" "$dir"

dir=$(new_case yarn-berry)
cat >"$dir/yarn.lock" <<'EOF'
__metadata:
  version: 8

"@cacheable/memory@npm:^2.2.0":
  version: 2.2.1
  resolution: "@cacheable/memory@npm:2.2.1"
EOF
expect "yarn berry (npm: protocol)" "$SCOPED_HIT" "$dir"

dir=$(new_case yarn-multi-range)
cat >"$dir/yarn.lock" <<'EOF'
"keyv@^5.0.0", "keyv@^6.0.0":
  version "6.0.0"
EOF
expect "yarn multi-range header" "$KEYV_HIT" "$dir"

# --- negative cases -------------------------------------------------------

dir=$(new_case clean)
cat >"$dir/package-lock.json" <<'EOF'
{ "lockfileVersion": 3, "packages": { "node_modules/keyv": { "version": "4.5.4" } } }
EOF
expect "unaffected version is not reported" "" "$dir"

dir=$(new_case vendored)
mkdir -p "$dir/node_modules/some-dep"
cat >"$dir/node_modules/some-dep/package-lock.json" <<'EOF'
{ "lockfileVersion": 3, "packages": { "node_modules/keyv": { "version": "6.0.0" } } }
EOF
expect "lockfile vendored inside node_modules is skipped" "" "$dir"

dir=$(new_case malformed)
printf 'not json at all {{{' >"$dir/package-lock.json"
cat >"$dir/pnpm-lock.yaml" <<'EOF'
lockfileVersion: '9.0'

packages:

  'keyv@6.0.0':
    resolution: {integrity: sha512-example}
EOF
expect "malformed lockfile does not abort the scan" "$KEYV_HIT" "$dir"

# --- result ---------------------------------------------------------------

if ((failures > 0)); then
	printf '\n%d test%s failed.\n' "$failures" "$([[ $failures -eq 1 ]] || printf s)" >&2
	exit 1
fi

printf '\nAll lockfile tests passed.\n'