Skip to content

Fix usage scanner fixture false positives#862

Open
MANOJ-80 wants to merge 1 commit into
OWASP:mainfrom
MANOJ-80:fix/861-usage-scan-fixture-exclusions
Open

Fix usage scanner fixture false positives#862
MANOJ-80 wants to merge 1 commit into
OWASP:mainfrom
MANOJ-80:fix/861-usage-scan-fixture-exclusions

Conversation

@MANOJ-80

Copy link
Copy Markdown

Closes #861

Summary

  • Exclude example/test/fixture directories from usage scanning.
  • Prevent PD001/PD002 from treating fixture/demo imports as root project source usage.
  • Add regression coverage at scanner and override context levels.

Verification

npm test -- tests/usage.test.ts tests/overrides/context-builder.test.ts tests/overrides/detectors/pd001.test.ts tests/overrides/detectors/pd002.test.ts --runInBand
npm run build

Copilot AI review requested due to automatic review settings July 21, 2026 15:44
@MANOJ-80
MANOJ-80 requested a review from sonukapoor as a code owner July 21, 2026 15:44

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses false-positive phantom-dependency findings (notably PD001/PD002 under --check-overrides) by ensuring the usage scanner ignores imports that appear only in example/test/fixture directories, and adds regression tests to lock the behavior in.

Changes:

  • Add a usage-scanner–specific exclusion set that extends the shared EXCLUDED_DIRS with examples/, tests/, fixtures/, __tests__/, and __fixtures__/ (plus singular forms).
  • Update both scanProjectForPackageUsage and scanAllImports to apply the new usage-specific directory exclusions.
  • Add regression tests covering scanner behavior and buildOverrideContext integration to ensure excluded directories don’t influence importedPackageNames.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File Description
src/usage/scanner.ts Introduces USAGE_EXCLUDED_DIRS and applies it to directory traversal for both usage-scan entrypoints.
tests/usage.test.ts Adds regression tests verifying example/test/fixture directories are excluded for both targeted and full import scans.
tests/overrides/context-builder.test.ts Adds integration coverage ensuring override context import collection ignores excluded directories.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

investigate: PD001/PD002 may over-report phantom deps from example/fixture references

2 participants