test(cli): add unit tests for CVE to GHSA conversion utility

Add comprehensive test coverage for cve-to-ghsa.mts:
- Successful CVE to GHSA ID conversion
- No GHSA found error handling
- Missing GHSA ID in response
- CResult error handling
- Generic error handling
- Cache TTL verification (30 days)

Author: jdalton

packages/cli/test/unit/utils/cve-to-ghsa.test.mts

@@ -0,0 +1,156 @@
+/**
+ * Unit tests for CVE to GHSA conversion utility.
+ *
+ * Purpose:
+ * Tests the CVE to GHSA ID conversion using GitHub API.
+ *
+ * Test Coverage:
+ * - convertCveToGhsa function
+ * - Successful conversion
+ * - No GHSA found for CVE
+ * - API errors
+ *
+ * Related Files:
+ * - src/utils/cve-to-ghsa.mts (implementation)
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+// Mock the github utility.
+const mockGetOctokit = vi.hoisted(() =>
+  vi.fn(() => ({
+    rest: {
+      securityAdvisories: {
+        listGlobalAdvisories: vi.fn(),
+      },
+    },
+  })),
+)
+
+const mockCacheFetch = vi.hoisted(() => vi.fn())
+const mockWithGitHubRetry = vi.hoisted(() => vi.fn())
+const mockHandleGitHubApiError = vi.hoisted(() =>
+  vi.fn(() => ({
+    ok: false,
+    message: 'GitHub API error',
+  })),
+)
+
+vi.mock('../../../src/utils/git/github.mjs', () => ({
+  getOctokit: mockGetOctokit,
+  cacheFetch: mockCacheFetch,
+  withGitHubRetry: mockWithGitHubRetry,
+  handleGitHubApiError: mockHandleGitHubApiError,
+}))
+
+describe('cve-to-ghsa', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.resetModules()
+  })
+
+  describe('convertCveToGhsa', () => {
+    it('returns GHSA ID for valid CVE', async () => {
+      mockCacheFetch.mockResolvedValue({
+        data: [{ ghsa_id: 'GHSA-xxxx-yyyy-zzzz' }],
+      })
+
+      const { convertCveToGhsa } = await import(
+        '../../../src/utils/cve-to-ghsa.mts'
+      )
+
+      const result = await convertCveToGhsa('CVE-2021-44228')
+
+      expect(result.ok).toBe(true)
+      if (result.ok) {
+        expect(result.data).toBe('GHSA-xxxx-yyyy-zzzz')
+      }
+    })
+
+    it('returns error when no GHSA found for CVE', async () => {
+      mockCacheFetch.mockResolvedValue({
+        data: [],
+      })
+
+      const { convertCveToGhsa } = await import(
+        '../../../src/utils/cve-to-ghsa.mts'
+      )
+
+      const result = await convertCveToGhsa('CVE-2021-99999')
+
+      expect(result.ok).toBe(false)
+      if (!result.ok) {
+        expect(result.message).toContain('No GHSA found for CVE')
+      }
+    })
+
+    it('returns error when GHSA ID is missing in response', async () => {
+      mockCacheFetch.mockResolvedValue({
+        data: [{ ghsa_id: undefined }],
+      })
+
+      const { convertCveToGhsa } = await import(
+        '../../../src/utils/cve-to-ghsa.mts'
+      )
+
+      const result = await convertCveToGhsa('CVE-2021-12345')
+
+      expect(result.ok).toBe(false)
+      if (!result.ok) {
+        expect(result.message).toContain('No GHSA ID found in response')
+      }
+    })
+
+    it('handles CResult error from API', async () => {
+      const apiError = {
+        ok: false,
+        message: 'API rate limit exceeded',
+      }
+      mockCacheFetch.mockRejectedValue(apiError)
+
+      const { convertCveToGhsa } = await import(
+        '../../../src/utils/cve-to-ghsa.mts'
+      )
+
+      const result = await convertCveToGhsa('CVE-2021-44228')
+
+      expect(result.ok).toBe(false)
+      if (!result.ok) {
+        expect(result.message).toBe('API rate limit exceeded')
+      }
+    })
+
+    it('handles generic errors', async () => {
+      mockCacheFetch.mockRejectedValue(new Error('Network error'))
+
+      const { convertCveToGhsa } = await import(
+        '../../../src/utils/cve-to-ghsa.mts'
+      )
+
+      const result = await convertCveToGhsa('CVE-2021-44228')
+
+      expect(result.ok).toBe(false)
+      expect(mockHandleGitHubApiError).toHaveBeenCalled()
+    })
+
+    it('uses 30-day cache TTL', async () => {
+      mockCacheFetch.mockResolvedValue({
+        data: [{ ghsa_id: 'GHSA-xxxx-yyyy-zzzz' }],
+      })
+
+      const { convertCveToGhsa } = await import(
+        '../../../src/utils/cve-to-ghsa.mts'
+      )
+
+      await convertCveToGhsa('CVE-2021-44228')
+
+      // Verify cache was called with correct TTL (30 days in ms).
+      const thirtyDaysMs = 30 * 24 * 60 * 60 * 1000
+      expect(mockCacheFetch).toHaveBeenCalledWith(
+        expect.stringContaining('cve-to-ghsa::CVE-2021-44228'),
+        expect.any(Function),
+        thirtyDaysMs,
+      )
+    })
+  })
+})