[Copilot]

The repo had no CI and no assertions around the shipped fixtures. This adds a minimal build/test pipeline and unit tests that verify package restore works and that the existing fixtures behave as documented.

CI (.github/workflows/ci.yml)

• Runs on push to main, pull requests and manual dispatch, across Node 22.x and 24.x
• Three steps: npm ci (package restore, validates lockfile is in sync), npm run build, npm test
• Actions are SHA-pinned; a github-actions Dependabot ecosystem was added so the pins stay current

Unit tests

Node's built-in test runner (node:test + node:assert/strict), so no new dependencies:

• src/fixtures.test.ts covers loading the SBOM and advisory fixtures, branch diff revival into a Map, malware matching plus the --malware-cutoff boundary, the shipped ignore.example.yml, and PURL search (exact / semver range / wildcard / no-match)
• src/cli.test.ts spawns the built CLI offline against the fixtures exactly as the README documents, asserting malware match lines, JSON search output and the no-match path

npm test now runs these alongside the two pre-existing harness scripts, which are unchanged:

"test": "node --test dist/fixtures.test.js dist/cli.test.js && node dist/test-fixture-match.js && node dist/test-branch-search.js"

Test files are listed explicitly rather than globbed, since positional glob handling in node --test varies by Node version and shell.

Documentation

• README's test section documented output that no longer matches the fixtures (chalk-org/chalk-repo, single match). The fixtures produce advanced-security/test-sbom-repo with a default-branch match and a test branch match
• Added TESTING.md, which CONTRIBUTING.md already linked to but did not exist
• CHANGELOG entry

Not included

npm run lint is currently broken (ESLint 9 requires a flat eslint.config.js; the repo still has .eslintrc.json), so lint is intentionally omitted from the workflow. That migration would touch source across the repo and seems better as its own change. Related: CONTRIBUTING.md references a lint:fix script that does not exist.

[Copilot]

🟢 Approval recommended

There are no active review issues with the CI, fixture-test, and offline CLI-test changes.

No open issues 🎉

What changed in this PR

Adds a basic CI pipeline and automated assertions for the toolkit’s shipped fixtures and offline CLI behavior, without introducing test dependencies.

Changes:

• Runs package restore, build, and tests on Node 22.x and 24.x, with pinned GitHub Actions and Dependabot updates.
• Adds fixture and CLI tests alongside the existing harness scripts.
• Documents testing procedures and corrects README output to include both default-branch and test branch matches.

File	Description
TESTING.md	Documents test commands, coverage, fixtures, and manual API testing.
src/​fixtures.test.ts	Adds assertions for fixture loading, matching, ignore rules, and PURL searches.
src/​cli.test.ts	Tests offline CLI matching, JSON search output, and no-match behavior.
README.md	Updates test instructions and corrects fixture output examples.
package.json	Adds the new test files to the existing test command.
CHANGELOG.md	Records CI, test coverage, and documentation changes.
.github/​workflows/​ci.yml	Adds package restore, build, and test jobs for Node 22.x and 24.x.
.github/​dependabot.yml	Adds weekly updates for GitHub Actions dependencies.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are reported for the CI, fixture-test, and documentation changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The CI and offline fixture/CLI testing changes have no active review issues.

No open issues 🎉

_{Review effort: Balanced}