fix(pr): apply the security label so security-only can fire

test/auto-merge.test.tsmodified+31-0

Changes to test/auto-merge.test.ts

		⋯232 linesShow the 232 lines above this hunk@@ -233,3 +233,34 @@ describe('auto-merge evaluation', () => {
233	233	})
234	234	})
235	235	})
	236	+
	237	+describe('security-only, end to end', () => {
	238	+ /**
	239	+ * `security-only` tests for `security.label`, and until the label was
	240	+ * actually applied to a pull request the condition could never once fire.
	241	+ * These pin the contract from both sides.
	242	+ */
	243	+ it('failure case - no security label means no match', () => {
	244	+ const decision = evaluateAutoMerge(makePR([makeUpdate({ updateType: 'major' })]), makeConfig(['security-only']), true)
	245	+
	246	+ expect(decision.eligible).toBe(false)
	247	+ })
	248	+
	249	+ it('success case - the label Buddy now applies satisfies the condition', () => {
	250	+ const pr = makePR([makeUpdate({ updateType: 'major' })], { labels: ['dependencies', 'security'] })
	251	+
	252	+ const decision = evaluateAutoMerge(pr, makeConfig(['security-only']), true)
	253	+
	254	+ // A major update, admitted purely because it resolves an advisory.
	255	+ expect(decision.eligible).toBe(true)
	256	+ expect(decision.reason).toContain('security advisory')
	257	+ })
	258	+
	259	+ it('success case - a renamed label is matched, not the default', () => {
	260	+ const config = makeConfig(['security-only'])
	261	+ config.security = { label: 'vulnerability' }
	262	+
	263	+ expect(evaluateAutoMerge(makePR([makeUpdate()], { labels: ['vulnerability'] }), config, true).eligible).toBe(true)
	264	+ expect(evaluateAutoMerge(makePR([makeUpdate()], { labels: ['security'] }), config, true).eligible).toBe(false)
	265	+ })
	266	+})