From 8365ff0cc743ebde5ec45c34475b8f42079bf2db Mon Sep 17 00:00:00 2001
From: dhgoal <153369624+dhgoal@users.noreply.github.com>
Date: Sun, 5 Jul 2026 14:37:58 +0900
Subject: [PATCH] test(enrichment): cover extractDependencyChanges edge cases
 in dependency-scan

Adds focused unit coverage for the pure extractDependencyChanges parser, which
had only a single version-bump case: a newly added dependency (null from), a
removed-only dependency (no change), an unchanged version, a skipped
non-manifest file, and multiple bumps in one manifest. Test-only.
---
 .../test/dependency-scan.test.ts              | 54 +++++++++++++++++++
 1 file changed, 54 insertions(+)

diff --git a/review-enrichment/test/dependency-scan.test.ts b/review-enrichment/test/dependency-scan.test.ts
index 3240ec7d98..a7f4536ee2 100644
--- a/review-enrichment/test/dependency-scan.test.ts
+++ b/review-enrichment/test/dependency-scan.test.ts
@@ -26,3 +26,57 @@ test("extractDependencyChanges skips real file headers via the shared discrimina
     { ecosystem: "npm", package: "lodash", from: "4.17.20", to: "4.17.21" },
   ]);
 });
+
+test("extractDependencyChanges reports a newly ADDED dependency with a null `from`", () => {
+  const changes = extractDependencyChanges([
+    {
+      path: "package.json",
+      patch: ["@@ -1,1 +1,2 @@", '     "dependencies": {', '+    "left-pad": "1.3.0",'].join("\n"),
+    },
+  ]);
+  assert.deepEqual(changes, [{ ecosystem: "npm", package: "left-pad", from: null, to: "1.3.0" }]);
+});
+
+test("extractDependencyChanges ignores a removed-only dependency (nothing present after the change)", () => {
+  const changes = extractDependencyChanges([
+    { path: "package.json", patch: ["@@ -1,2 +1,1 @@", '-    "left-pad": "1.3.0",'].join("\n") },
+  ]);
+  assert.deepEqual(changes, []);
+});
+
+test("extractDependencyChanges ignores an unchanged version (added === removed)", () => {
+  // A line reformatted/moved but whose version is identical must NOT surface as a change.
+  const changes = extractDependencyChanges([
+    {
+      path: "package.json",
+      patch: ["@@ -1,2 +1,2 @@", '-    "lodash": "4.17.21",', '+    "lodash": "4.17.21",'].join("\n"),
+    },
+  ]);
+  assert.deepEqual(changes, []);
+});
+
+test("extractDependencyChanges skips a non-manifest file", () => {
+  const changes = extractDependencyChanges([
+    { path: "src/index.ts", patch: ["@@ -1 +1,1 @@", '+    "lodash": "4.17.21",'].join("\n") },
+  ]);
+  assert.deepEqual(changes, []);
+});
+
+test("extractDependencyChanges extracts multiple version bumps from one manifest, in order", () => {
+  const changes = extractDependencyChanges([
+    {
+      path: "package.json",
+      patch: [
+        "@@ -1,4 +1,4 @@",
+        '-    "react": "18.2.0",',
+        '+    "react": "18.3.0",',
+        '-    "lodash": "4.17.20",',
+        '+    "lodash": "4.17.21",',
+      ].join("\n"),
+    },
+  ]);
+  assert.deepEqual(changes, [
+    { ecosystem: "npm", package: "react", from: "18.2.0", to: "18.3.0" },
+    { ecosystem: "npm", package: "lodash", from: "4.17.20", to: "4.17.21" },
+  ]);
+});