test: add provenance tests

[43081j]

No description provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
npmx.dev	Ready	Preview, Comment	Feb 6, 2026 11:36am

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs.npmx.dev	Ignored	Preview	Feb 6, 2026 11:36am
npmx-lunaria	Ignored		Feb 6, 2026 11:36am

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[coderabbitai]

📝 Walkthrough

Walkthrough

This pull request introduces a comprehensive unit test suite for the parseAttestationToProvenanceDetails function in test/unit/server/utils/provenance.spec.ts. The tests validate input handling, DSSE envelope and base64 payload processing, SLSA attestation parsing for both GitHub Actions v1 and GitLab CI attestations, and fallback mechanisms to v0.2 attestations. Coverage includes version precedence logic, provider identification for various builder types, repository URL normalisation by removing trailing slashes and .git suffixes, build file URL extraction, and edge case handling for missing predicates, non-URL invocations, and empty builder identifiers. The addition consists of 426 lines of test code.

Suggested reviewers

• danielroe

🚥 Pre-merge checks | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The pull request has no description provided by the author, making it impossible to assess whether the description relates to the changeset.	Add a clear pull request description that explains the purpose of adding the provenance unit tests, what scenarios are covered, and any relevant context for reviewers.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch jg/test-proovenancey

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}