test(enrichment): cover license-check analyzer

[Florcitaq]

Closes #2114.

Summary

• Add dedicated REES unit coverage for the license-check analyzer.
• Cover permissive licenses staying silent, copyleft and unknown licenses being flagged, empty/missing license metadata, PyPI/Go deps.dev system resolution, no-change/no-fetch behavior, and deps.dev failures failing safe.

Validation

• npm run build
• npx prettier --check test/license-check.test.ts
• node --test --experimental-strip-types "test/license-check.test.ts"
• npm run validate:sourcemaps
• git diff --check

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-02 04:45:29 UTC}

1 file · 1 AI reviewer · no blockers · readiness 55/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This PR adds focused unit coverage for the license-check analyzer through the compiled `dist` entrypoint, stubbing deps.dev responses to exercise classification, URL construction, non-fetch cases, and fail-safe behavior. The visible change is test-only and does not alter production behavior, and the assertions are concrete enough to catch regressions in ecosystem mapping and scoped package encoding. No blocking defect is visible in the provided diff.

Nits — 5 non-blocking

• nit: `review-enrichment/test/license-check.test.ts:156` only covers all-failing scans, so it does not prove a deps.dev failure for one package still allows later packages in the same scan to be checked.
• nit: `review-enrichment/test/license-check.test.ts:156` combines HTTP failure and thrown-fetch failure in one test, which makes the failing path less obvious when one branch regresses.
• Add a mixed-result case in `review-enrichment/test/license-check.test.ts` with one deps.dev failure followed by one copyleft package so the per-package fail-safe behavior is locked down.
• Split the HTTP 503 and thrown-fetch assertions in `review-enrichment/test/license-check.test.ts` into separate tests for clearer regression output.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2114
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:XS; 1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 0 registered-repo PR(s), 0 merged, 0 issue(s).
Contributor context	❌ No public Gittensor match	Florcitaq; not a blocker.
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: Florcitaq
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Contributor context: Public profile only; not a blocker.
• Related work: Items reference the same linked issue test(enrichment): unit coverage for the license-check analyzer #2114. (issue #2114)
• Related work: Open PR work references issue test(enrichment): unit coverage for the license-check analyzer #2114. (issue #2114)
• Related work: Titles/paths share 5 meaningful terms. (PR #2396)
• Additional title-only matches omitted; title-only overlap does not block.

Contributor next steps

• Review top overlaps.
• Add a concise scope and risk note.
• Await review-lane availability.
• Triage stale or unlinked PRs.
• Refresh registry data or choose a registered active repo.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[Florcitaq]

Addressed the Gittensory nits:

• added an explicit licenses: [] assertion alongside absent license metadata
• added a throwing fetch/network-error fails-safe assertion
• renamed the PyPI/Go test so the copyleft PyPI fixture is described accurately

Re-ran:

• npm run build
• npx prettier --check test/license-check.test.ts
• node --test --experimental-strip-types "test/license-check.test.ts"
• git diff --check

[Florcitaq]

Addressed the follow-up nits as well:

• assert npm deps.dev URL construction, including scoped package encoding (@scope/encoded)
• cover a manifest addition with a non-extractable version (workspace:*) in the no-fetch path

Re-ran:

• npm run build
• npx prettier --check test/license-check.test.ts
• node --test --experimental-strip-types "test/license-check.test.ts"
• git diff --check

[JSONbored]

Moving forward, please do not open more than 2 PRs at a time - in a day or so the reviewbot will automatically close PRs above the 2 per contributor threshold.