fix(merge): the risk gate scored a commit it was not merging #5612
1 changed file+17−5
Modifiedsrc/lib/intelligence.ts+17−5View fileUnifiedSplit
@@ -79,11 +79,14 @@ export interface RepoHealthReport {
7979 /** Every manifest path found in the tree (workspace members included). */
8080 manifests: string[];
8181 /**
82 * How many of `manifests` were actually opened and parsed.
82 * How many of `manifests` were opened AND successfully parsed.
8383 *
84 * Below `manifests.length` only when the tree exceeds the read cap, and
85 * present so a truncated walk cannot be mistaken for a complete one —
86 * the failure this whole category just came back from.
84 * Below `manifests.length` when the tree exceeds the read cap, and also
85 * when a manifest could not be read or parsed. Counting attempts would
86 * let an unparseable manifest report itself as scanned — a file that
87 * contributed nothing to `total` must not inflate the number that says
88 * how much of the tree was read. That "we looked" / "we succeeded"
89 * conflation is the failure this whole category came back from.
8790 */
8891 manifestsScanned: number;
8992 /**
@@ -1215,6 +1218,12 @@ async function analyzeDependencyScore(
12151218
12161219 // Distinct names, not summed entry counts — see the `total` doc comment.
12171220 const depNames = new Set<string>();
1221 // Manifests actually opened AND parsed. Counting attempts instead would let
1222 // an unparseable manifest report itself as scanned, which is the same
1223 // "we looked" / "we succeeded" conflation this whole category came back
1224 // from — a file we could not read contributed nothing to `total`, so it
1225 // must not inflate the number that says how much of the tree we read.
1226 let parsedCount = 0;
12181227 // Non-JS manifests are counted rather than named: the parsers below are
12191228 // deliberately rough and their output is not reliable enough to dedupe on.
12201229 let unnamedTotal = 0;
@@ -1235,6 +1244,7 @@ async function analyzeDependencyScore(
12351244 ]) {
12361245 depNames.add(name);
12371246 }
1247 parsedCount++;
12381248 } catch {
12391249 // Unparseable or unreadable manifest — skipped, and it stays counted
12401250 // in `manifests` so the gap between found and parsed stays visible.
@@ -1257,6 +1267,7 @@ async function analyzeDependencyScore(
12571267 const tableDeps =
12581268 content.match(/^[a-zA-Z0-9_-]+\s*=\s*["'{^~>=<]/gm)?.length ?? 0;
12591269 unnamedTotal += Math.max(arrayDeps, tableDeps);
1270 parsedCount++;
12601271 } catch {
12611272 // parse error
12621273 }
@@ -1272,6 +1283,7 @@ async function analyzeDependencyScore(
12721283 unnamedTotal += content
12731284 .split("\n")
12741285 .filter((l) => l.trim() && !l.trim().startsWith("#")).length;
1286 parsedCount++;
12751287 } catch {
12761288 // read error
12771289 }
@@ -1296,7 +1308,7 @@ async function analyzeDependencyScore(
12961308 lockfileExists: hasLockfile,
12971309 manifestFound,
12981310 manifests,
1299 manifestsScanned: toRead.length,
1311 manifestsScanned: parsedCount,
13001312 vulnerabilities: {
13011313 assessed: false,
13021314 reason:
13031315
c comment · e edit title · m merge · a approve · r request changes · ? shortcuts