test: add coverage for pr_safety path-matching helpers

[madara88645]

What

Adds two new unit test files that give the pure, security-adjacent path-matching helpers behind the PR Safety verdict feature their first direct unit test coverage:

• tests/test_pr_safety_path_rules_helpers.py — covers app/pr_safety/path_rules.py:

  • normalize_paths (backslash normalization, whitespace/empty-entry dropping, dedup-after-normalization, order preservation)
  • _matches_any_pattern (match/no-match, empty pattern set, case sensitivity, short-circuit behavior)
  • list_test_files (filtering, normalization, dedup, one representative case per TEST_FILE_PATTERNS family)
  • list_source_files_needing_tests (filtering, exclusion of test/doc/config/unknown-extension files, normalization, order preservation)

• tests/test_pr_safety_repo_signals_pattern_matching.py — covers app/pr_safety/repo_signals.py:

  • _matches_repo_pattern (anchored vs. unanchored patterns, */**/? glob semantics, trailing-slash directory wildcards, empty/whitespace patterns, backslash normalization, case sensitivity, regex-metacharacter escaping)
  • _matches_any_repo_pattern (match/no-match/empty list)
  • _matches_ordered_patterns (gitignore-style ordered include/exclude evaluation, negation, last-match-wins semantics)
  • _is_safe_relative_path (path-traversal guarding: absolute paths, leading/embedded/trailing .. components, .-segment tolerance, filenames that merely contain .. as a substring)

Why

These functions decide whether a changed file is "safe"/expected for the PR-safety verdict — including CODEOWNERS pattern matching, GitHub Actions paths/paths-ignore evaluation, and the relative-path traversal guard used before any filesystem read in repo_signals.py. Before this PR they only had indirect coverage through higher-level functions (group_changed_files, detect_risky_areas, collect_repo_signals) in the existing tests/test_pr_safety_path_rules.py and tests/test_pr_safety_repo_signals.py files — none of the tests exercised these helpers, or their edge cases (path-traversal variants, pattern anchoring/negation ordering, empty inputs), directly. Given their security-adjacent role, direct coverage of the edge cases makes regressions easier to catch and easier to diagnose when they fail.

Scope

• New test files only. No source, config, lockfile, or CI files were modified.
• Existing tests/test_pr_safety_path_rules.py and tests/test_pr_safety_repo_signals.py were left untouched — new files use distinct names to avoid overlap.

Test plan

• python -m pytest tests/test_pr_safety_path_rules_helpers.py tests/test_pr_safety_repo_signals_pattern_matching.py -q → 52 passed
• python -m pytest tests/ -k pr_safety -q → 159 passed (full existing pr_safety suite unaffected)

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
compiler	Ready	Preview	Aug 1, 2026 4:17am