fix(tests): verify the semver cache works, not just that it exists

[oxyc]

3 of 6 composer-update test files were failing on master. All three had the same cause, and none of the symptoms pointed at it.

The bug

ensure_semver_vendor caches a composer/semver vendor dir and guarded it with:

if [ ! -f "$cache/vendor/autoload.php" ]; then ... build ... fi

Existence is too weak a test. An interrupted composer require leaves autoload.php and vendor/composer/ behind without vendor/composer/ClassLoader.php. The local cache had exactly that shape:

vendor/composer/  ->  autoload_real.php  autoload_static.php  installed.json  semver/
                      (no ClassLoader.php)

composer/semver was there. The autoloader's own class file wasn't.

Why it stayed broken

The guard was satisfied, so the cache was never rebuilt. Every run copied a broken autoloader into the test project, the PHP helpers fatally errored on the missing ClassLoader, and their non-JSON output reached jq as:

jq: parse error: Invalid numeric literal at line 2, column 8

That reads like a bug in the helper's JSON output, not a missing dependency — which is why it sat unfixed. And it's sticky: once the cache is in that state it stays broken for every future run, on that machine, forever.

The fix

The guard now exercises the cache instead of inspecting it:

_semver_cache_ok() {
  local c="$1"
  [ -f "$c/vendor/autoload.php" ] || return 1
  ( cd "$c" && PATH="$_ORIGINAL_PATH" php -r \
      'require "vendor/autoload.php"; exit(class_exists("Composer\\Semver\\Semver") ? 0 : 1);' \
  ) >/dev/null 2>&1
}

If it fails, the cache is deleted and rebuilt from scratch rather than built on top of a partial tree, and the loud-failure path now says a working bootstrap could not be produced.

Result

compute-min-safe-constraints.test.sh   PASS — 13 assertions
is-still-vulnerable.test.sh            PASS —  9 assertions
lib-functions.test.sh                  PASS — 47 assertions
no-widen-still-creates-pr.test.sh      PASS
open-or-refresh-pr.test.sh             PASS — 15 assertions
update-orchestration.test.sh           PASS — 31 assertions

SUMMARY: 6 file(s) passed, 0 failed

No assertion changed and no script under test changed — only the harness.

Why it matters

These are the tests covering compute-min-safe-constraints.php and is-still-vulnerable.php — the code that decides which version the vuln scanner bumps you to, and whether a "fix" actually leaves the affected range. Half the suite being red meant a regression there would not have been caught.

This is the second bug of this class in the same helper; the first was ensure_semver_vendor shelling out to the fake composer shim (#41).

🤖 Generated with Claude Code