feat(composer-update): refresh open vuln PR in place (unblock remediation, stop daily comments)

[oxyc]

Addresses two operational problems with the vuln auto-update flow, plus test coverage.

Problem

Dedup was label-only: if any vuln-update PR was open, the action set skip=true and skipped both the update and PR-create steps, only posting a comment when findings differed. That meant:

1. A single un-merged PR froze all future auto-remediation. New vulnerabilities were never composed into any branch — just mentioned in a comment on the stale PR. The fix for them didn't exist anywhere until that PR was merged/closed.
2. Daily duplicate comments. The "differs?" check compared the new set against the marker in the PR body, which never updated. So once the set drifted (A → A,B), every nightly run saw "differs" and re-posted the same comment — every day until resolved.

Change

One rolling PR per label with three modes (decided in lib.sh, unit-tested):

Mode	When	Action
create	no open PR	open one (as before)
skip	open PR already records this exact set	do nothing (silent)
update	open PR, set changed	refresh in place

update force-pushes base + current fix to the existing PR's head branch, rewrites the body (so the set marker tracks the latest findings), and drops one timeline comment. Rewriting the marker is what makes a subsequently-unchanged set hit skip next run — which kills the daily-comment loop (#3). Unfixable new findings (no lock change) still refresh body/comment so they surface, without a force-push.

Net: the open PR always reflects the current full fix set; remediation no longer stalls behind an un-merged PR.

Tests (#6)

Extracted the decision logic to lib.sh — extract_pr_set() and decide_pr_action() — and added unit tests in lib-functions.test.sh (create / skip / update / set-grew / set-shrank / no-marker / marker extraction). The dedup path previously had zero coverage. Full suite: 5 files, 0 failures.

Notes

• The gh/git calls (force-push, pr edit, pr comment) stay integration-level as before; the extracted decision logic is the unit-tested core.
• Force-push clobbers manual edits to the auto-generated branch — acceptable for a bot-owned PR, and the goal is "always reflect current fix."
• Out of scope by request: red-job semantics and auto-merge.

Takes effect downstream once v2 is moved to the merge commit.

🤖 Generated with Claude Code