@@ -118,4 +118,62 @@ snapshots:
118118"root dependency 'missing-owner' is missing from scripts/lib/dependency-ownership.json",
119119]);
120120});
121+122+it("does not mark plugin importer dependencies as stale ownership records", () => {
123+const repoRoot = makeTempRepo();
124+writeRepoFile(
125+repoRoot,
126+"package.json",
127+JSON.stringify({
128+dependencies: {
129+"core-lib": "1.0.0",
130+},
131+}),
132+);
133+writeRepoFile(
134+repoRoot,
135+"pnpm-lock.yaml",
136+`
137+lockfileVersion: '9.0'
138+importers:
139+ .:
140+ dependencies:
141+ core-lib:
142+ specifier: 1.0.0
143+ version: 1.0.0
144+ extensions/web-readability:
145+ dependencies:
146+ plugin-readable:
147+ specifier: 2.0.0
148+ version: 2.0.0
149+packages:
150+ core-lib@1.0.0: {}
151+ plugin-readable@2.0.0: {}
152+snapshots:
153+ core-lib@1.0.0: {}
154+ plugin-readable@2.0.0: {}
155+`,
156+);
157+writeRepoFile(
158+repoRoot,
159+"scripts/lib/dependency-ownership.json",
160+JSON.stringify({
161+schemaVersion: 1,
162+dependencies: {
163+"core-lib": { owner: "core:test", class: "core-runtime", risk: ["network"] },
164+"plugin-readable": {
165+owner: "plugin:web-readability",
166+class: "plugin-runtime",
167+risk: ["html"],
168+},
169+"removed-lib": { owner: "core:test", class: "core-runtime", risk: ["unused"] },
170+},
171+}),
172+);
173+174+const report = collectSbomRiskReport({ repoRoot });
175+176+expect(report.ownershipGaps).toEqual([]);
177+expect(report.staleOwnershipRecords).toEqual(["removed-lib"]);
178+});
121179});
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。