test(enrichment): unit coverage for the IaC-misconfig analyzer pure scanner

[JSONbored]

review-enrichment/src/analyzers/iac-misconfig.ts (218 lines) has no test. isRelevantConfigPath and scanPatchForIacMisconfig are pure/path+patch-driven and easily unit-tested for full branch coverage. Part of the REES analyzer runtime.

Deliverables

• Create review-enrichment/test/iac-misconfig.test.ts
• isRelevantConfigPath: Terraform/YAML/Dockerfile/compose relevant paths vs unrelated source paths
• scanPatchForIacMisconfig: each misconfig pattern the scanner recognizes (added lines only), and a clean patch → no findings
• Finding shape (file/line/rule/severity) and stable ordering
• Network/request wiring (scanIacMisconfig) can stay out of scope — cover the pure exports

References

• review-enrichment/src/analyzers/iac-misconfig.ts:42
• review-enrichment/src/analyzers/iac-misconfig.ts:61
• review-enrichment/src/analyzers/iac-misconfig.ts:201

Part of #1499.

---

size: S · gittensor:bug

[linear-code]

JSO-2213

[luciferlive112116]

Follow-up scope (not covered by the original test-only deliverable): extend the analyzer with additional OWASP Secure Headers rules (\coop-unsafe-none, \coep-unsafe-none) per the pattern in #3387. Happy to open a PR if a tracking issue is opened or this one is reopened for the rule batch.