From 3eff8c9cf2d8fe417a93aa0861990058c6893099 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sat, 24 Oct 2026 21:11:13 -0400
Subject: [PATCH] test(pr-review-cli): require a -diff lock file's changed URL
 in the full diff

main's .gitattributes marks package-lock.json, packages.lock.json and
*.lock -diff, so before #884 a lock file's resolved URL change reached the
reviewer as "Binary files differ". The full-diff test now gives the base
those attributes and a lock file, changes its resolved URL at the head, and
requires both the removed and the added line in the written diff. It fails
against the v0.65.8 workflow and passes on main.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/scripts/pr-review-cli.test.cjs | 28 ++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/.github/scripts/pr-review-cli.test.cjs b/.github/scripts/pr-review-cli.test.cjs
index ce077c6e..7ad49258 100644
--- a/.github/scripts/pr-review-cli.test.cjs
+++ b/.github/scripts/pr-review-cli.test.cjs
@@ -1106,7 +1106,10 @@ test("the review leaves each leg as an artifact named for the run, head and leg,
   );
 });
 
-test("the full diff shows text the head marks -diff or binary, or hides behind a NUL byte, in both lanes", () => {
+// The base marks lock files -diff, as main's own .gitattributes does, so a
+// changed resolved URL in one would otherwise reach the reviewer as
+// "Binary files differ".
+test("the full diff shows text the base or head marks -diff or binary, or hides behind a NUL byte, in both lanes", () => {
   const { spawnSync } = require("node:child_process");
   const git = (cwd, ...args) => {
     const result = spawnSync("git", args, { cwd, encoding: "utf8" });
@@ -1120,17 +1123,30 @@ test("the full diff shows text the head marks -diff or binary, or hides behind a
     git(origin, "init", "--quiet", "--initial-branch=main");
     git(origin, "config", "user.email", "t@example.com");
     git(origin, "config", "user.name", "t");
+    const lockAttributes =
+      "package-lock.json -diff\npackages.lock.json -diff\n*.lock -diff\n";
+    const lock = (url) =>
+      `{\n  "packages": {\n    "node_modules/a": {\n      "resolved": "${url}"\n    }\n  }\n}\n`;
     fs.writeFileSync(path.join(origin, "README"), "base\n");
+    fs.writeFileSync(path.join(origin, ".gitattributes"), lockAttributes);
+    fs.writeFileSync(
+      path.join(origin, "package-lock.json"),
+      lock("https://registry.npmjs.org/a/-/a-1.0.0.tgz"),
+    );
     git(origin, "add", ".");
     git(origin, "commit", "--quiet", "-m", "base");
     const base = git(origin, "rev-parse", "HEAD");
     fs.writeFileSync(
       path.join(origin, ".gitattributes"),
-      "hidden.sh -diff\nopaque.sh binary\n",
+      `${lockAttributes}hidden.sh -diff\nopaque.sh binary\n`,
     );
     fs.writeFileSync(path.join(origin, "hidden.sh"), "echo NO-DIFF-PAYLOAD\n");
     fs.writeFileSync(path.join(origin, "opaque.sh"), "echo BINARY-PAYLOAD\n");
     fs.writeFileSync(path.join(origin, "nul.sh"), "\0\necho NUL-PAYLOAD\n");
+    fs.writeFileSync(
+      path.join(origin, "package-lock.json"),
+      lock("https://lockfile.example/a-1.0.0.tgz"),
+    );
     git(origin, "add", ".");
     git(origin, "commit", "--quiet", "-m", "head");
     const head = git(origin, "rev-parse", "HEAD");
@@ -1169,6 +1185,14 @@ test("the full diff shows text the head marks -diff or binary, or hides behind a
     ]) {
       assert.match(diff, new RegExp(`^\\+echo ${payload}$`, "mu"), payload);
     }
+    assert.match(
+      diff,
+      /^- {6}"resolved": "https:\/\/registry\.npmjs\.org\/a\/-\/a-1\.0\.0\.tgz"$/mu,
+    );
+    assert.match(
+      diff,
+      /^\+ {6}"resolved": "https:\/\/lockfile\.example\/a-1\.0\.0\.tgz"$/mu,
+    );
     assert.match(
       fs.readFileSync(path.join(dir, "output"), "utf8"),
       /^written=true$/mu,