fix: make security fixtures fail closed

scripts/check-security-fixtures.ts

@@ -1,65 +1,10 @@
-import { spawnSync } from "node:child_process";
-import { readFile } from "node:fs/promises";
+import {
+  checkNonmatchingSecurityIncludeFixture,
+  checkSecurityFixtures,
+} from "./lib/security-fixture-check.ts";
 
-type Document = Record<string, unknown>;
-
-function record(value: unknown, label: string): Document {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new TypeError(`${label} must be an object`);
-  }
-  return value as Document;
-}
-
-const artifact = "artifacts/security/scan-fixture.sarif";
-const scan = spawnSync(
-  "node",
-  [
-    "scripts/security-scan.ts",
-    "--policy",
-    "tests/fixtures/security/secret-detection/forbidden-policy.json",
-    "--artifact",
-    artifact,
-  ],
-  { encoding: "utf8" },
+await checkNonmatchingSecurityIncludeFixture();
+await checkSecurityFixtures();
+process.stdout.write(
+  "Security fixtures: unmatched include rejected; 3 forbidden files detected\n",
 );
-if (scan.error || scan.signal || scan.status !== 1) {
-  throw new Error(
-    `forbidden security fixture did not fail exactly: ${scan.error?.message ?? scan.stderr}`,
-  );
-}
-
-const sarif = record(
-  JSON.parse(await readFile(artifact, "utf8")),
-  "security fixture SARIF",
-);
-const runs = Array.isArray(sarif.runs) ? sarif.runs : [];
-const run = record(runs[0], "security fixture SARIF run");
-const results = Array.isArray(run.results) ? run.results : [];
-const actual = results
-  .map((rawResult) => {
-    const result = record(rawResult, "security fixture result");
-    const locations = Array.isArray(result.locations) ? result.locations : [];
-    const location = record(locations[0], "security fixture location");
-    const physical = record(
-      location.physicalLocation,
-      "security fixture physical location",
-    );
-    const artifactLocation = record(
-      physical.artifactLocation,
-      "security fixture artifact location",
-    );
-    return `${String(artifactLocation.uri)}:${String(result.ruleId)}`;
-  })
-  .sort();
-const root = "tests/fixtures/security/secret-detection/forbidden";
-const expected = [
-  `${root}/config.json:assigned-secret`,
-  `${root}/dist.ts:assigned-secret`,
-  `${root}/source.ts:aws-access-key`,
-].sort();
-if (JSON.stringify(actual) !== JSON.stringify(expected)) {
-  throw new Error(
-    `security fixture findings mismatch: expected ${expected.join(", ")}; received ${actual.join(", ")}`,
-  );
-}
-process.stdout.write("Security fixtures: 3 forbidden files detected\n");