Scope test lockfiles by package manager and update cache tests (#1495)

* fix security alerts

* fix security alerts

* address Copilot suggestions

---------

Co-authored-by: gowridurgad <gowridurgad@gmail.com>

Author: gowridurgad

.gitignore

@@ -93,3 +93,18 @@ typings/
 
 # DynamoDB Local files
 .dynamodb/
+
+# Ignore everything inside fixture package-manager folders
+__tests__/data/npm/**
+__tests__/data/pnpm/**
+__tests__/data/yarn/**
+
+# Keep only fixture manifests + lockfiles
+!__tests__/data/npm/package.json
+!__tests__/data/npm/package-lock.json
+
+!__tests__/data/pnpm/package.json
+!__tests__/data/pnpm/pnpm-lock.yaml
+
+!__tests__/data/yarn/package.json
+!__tests__/data/yarn/yarn.lock

__tests__/cache-restore.test.ts

@@ -8,7 +8,13 @@ import * as utils from '../src/cache-utils';
 import {restoreCache} from '../src/cache-restore';
 
 describe('cache-restore', () => {
-  process.env['GITHUB_WORKSPACE'] = path.join(__dirname, 'data');
+  const packageManagers = ['yarn', 'npm', 'pnpm'] as const;
+  type PackageManager = (typeof packageManagers)[number];
+
+  const setWorkspaceFor = (pm: PackageManager) => {
+    process.env['GITHUB_WORKSPACE'] = path.join(__dirname, 'data', pm);
+  };
+  const originalGithubWorkspace = process.env['GITHUB_WORKSPACE'];
   if (!process.env.RUNNER_OS) {
     process.env.RUNNER_OS = 'Linux';
   }
@@ -25,7 +31,7 @@ describe('cache-restore', () => {
     'abf7c9b306a3149dcfba4673e2362755503bcceaab46f0e4e6fee0ade493e20c';
   const pnpmFileHash =
     '26309058093e84713f38869c50cf1cee9b08155ede874ec1b44ce3fca8c68c70';
-  const cachesObject = {
+  const cachesObject: Record<string, string> = {
     [npmCachePath]: npmFileHash,
     [pnpmCachePath]: pnpmFileHash,
     [yarn1CachePath]: yarnFileHash,
@@ -128,9 +134,11 @@ describe('cache-restore', () => {
       ['yarn', '1.2.3', yarnFileHash],
       ['npm', '', npmFileHash],
       ['pnpm', '', pnpmFileHash]
-    ])(
+    ] as const)(
       'restored dependencies for %s',
       async (packageManager, toolVersion, fileHash) => {
+        // Set workspace to the appropriate fixture folder
+        setWorkspaceFor(packageManager);
         getCommandOutputSpy.mockImplementation((command: string) => {
           if (command.includes('version')) {
             return toolVersion;
@@ -158,9 +166,11 @@ describe('cache-restore', () => {
       ['yarn', '1.2.3', yarnFileHash],
       ['npm', '', npmFileHash],
       ['pnpm', '', pnpmFileHash]
-    ])(
+    ] as const)(
       'dependencies are changed %s',
       async (packageManager, toolVersion, fileHash) => {
+        // Set workspace to the appropriate fixture folder
+        setWorkspaceFor(packageManager);
         getCommandOutputSpy.mockImplementation((command: string) => {
           if (command.includes('version')) {
             return toolVersion;
@@ -181,6 +191,11 @@ describe('cache-restore', () => {
   });
 
   afterEach(() => {
+    if (originalGithubWorkspace === undefined) {
+      delete process.env['GITHUB_WORKSPACE'];
+    } else {
+      process.env['GITHUB_WORKSPACE'] = originalGithubWorkspace;
+    }
     jest.resetAllMocks();
     jest.clearAllMocks();
   });

__tests__/data/npm/package-lock.json

@@ -0,0 +1,12 @@
+{
+  "name": "npm-fixture",
+  "engines": {
+    "node": "^24.0.0"
+  },
+  "dependencies": {
+    "accepts": "^1.3.8",
+    "array-flatten": "^3.0.0",
+    "bytes": "^3.1.2",
+    "content-disposition": "^0.5.4"
+  }
+}