fix(audit): extract DRIFT_SKIP_PREFIX constant; rewrite aggregate test

- Add DRIFT_SKIP_PREFIX constant to ci_checks.py; use it in the
  skip message and import it in audit.py to replace the brittle
  hardcoded string literal in the startswith() check.
- Rewrite test_cache_miss_does_not_block_other_checks to call
  _check_drift directly (monkeypatch was previously a no-op via
  run_baseline_checks which never invokes _check_drift); now
  builds a CIAuditResult directly and asserts the aggregate passes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Sergio Sisternes

src/apm_cli/commands/audit.py

@@ -695,7 +695,7 @@ def _audit_content_scan(
         and not package
         and (project_root / "apm.yml").exists()
     ):
-        from ..policy.ci_checks import _check_drift
+        from ..policy.ci_checks import DRIFT_SKIP_PREFIX, _check_drift
 
         lockfile_path = get_lockfile_path(project_root)
         if lockfile_path.exists():
@@ -723,7 +723,7 @@ def _audit_content_scan(
                 elif (
                     drift_check.passed
                     and not drift_findings
-                    and drift_check.message.startswith("drift skipped")
+                    and drift_check.message.startswith(DRIFT_SKIP_PREFIX)
                 ):
                     click.echo(
                         f"{STATUS_SYMBOLS['warning']} {drift_check.message}",

src/apm_cli/policy/ci_checks.py

@@ -407,6 +407,12 @@ def _check_includes_consent(
     )
 
 
+#: Prefix used in the drift :class:`CheckResult` message when the check is
+#: skipped due to a cold cache.  ``audit.py`` imports this to detect the
+#: skip case without comparing against a raw string literal.
+DRIFT_SKIP_PREFIX = "drift skipped"
+
+
 def _check_drift(
     project_root: Path,
     lockfile: LockFile,
@@ -453,7 +459,7 @@ def _check_drift(
                 name="drift",
                 passed=True,
                 message=(
-                    "drift skipped: install cache not populated "
+                    f"{DRIFT_SKIP_PREFIX}: install cache not populated "
                     "(run 'apm install' first or pass --no-drift)"
                 ),
             ),

tests/unit/policy/test_ci_checks.py

@@ -1195,32 +1195,39 @@ def _raise_cache_miss(*_args: object, **_kwargs: object) -> None:
     def test_cache_miss_does_not_block_other_checks(
         self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
     ) -> None:
-        """A cache miss on drift must leave the CIAuditResult passing when
-        the baseline checks all pass -- drift skip-with-info must not
-        propagate a failure to the aggregate result."""
+        """Adding the cache-miss drift result to a CIAuditResult must not
+        cause the aggregate to fail -- passed=True from the skip must
+        propagate correctly when combined with other passing checks."""
+        from apm_cli.deps.lockfile import LockFile
         from apm_cli.install.drift import CacheMissError
+        from apm_cli.policy.ci_checks import _check_drift
 
-        _write_apm_yml(tmp_path, deps=["owner/repo#v1.0.0"])
         _write_lockfile(
             tmp_path,
-            textwrap.dedent("""\
-                lockfile_version: '1'
+            textwrap.dedent("""                lockfile_version: '1'
                 generated_at: '2025-01-01T00:00:00Z'
-                dependencies:
-                  - repo_url: owner/repo
-                    resolved_ref: v1.0.0
-                    deployed_files:
-                      - .github/prompts/test.md
+                dependencies: []
             """),
         )
-        (tmp_path / ".github" / "prompts").mkdir(parents=True, exist_ok=True)
-        (tmp_path / ".github" / "prompts" / "test.md").write_text("# ok\n", encoding="utf-8")
+        lockfile = LockFile.read(tmp_path / "apm.lock.yaml")
+        assert lockfile is not None
 
         def _raise_cache_miss(*_args: object, **_kwargs: object) -> None:
             raise CacheMissError("cold cache")
 
         monkeypatch.setattr("apm_cli.install.drift.run_replay", _raise_cache_miss)
 
-        result = run_baseline_checks(tmp_path)
-        # Baseline checks (no drift) must still pass.
-        assert result.passed
+        drift_result, findings = _check_drift(tmp_path, lockfile)
+
+        # Simulate a CIAuditResult that already has passing baseline checks
+        # plus the drift skip result; the aggregate must remain passing.
+        from apm_cli.policy.models import CIAuditResult
+
+        aggregate = CIAuditResult()
+        aggregate.checks.append(CheckResult(name="lockfile-exists", passed=True, message="ok"))
+        aggregate.checks.append(CheckResult(name="ref-consistency", passed=True, message="ok"))
+        aggregate.checks.append(drift_result)
+
+        assert drift_result.passed, "cache miss must produce a passing drift result"
+        assert findings == [], "cache miss must produce no findings"
+        assert aggregate.passed, "cache-miss skip must not fail the aggregate CIAuditResult"