test(cli): make cmd-ci dry-run snapshot branch-agnostic

[John-David Dalton (jdalton)]

What

The socket ci integration test (packages/cli/test/integration/cli/cmd-ci.test.mts) hardcoded branchName: "main" in its dry-run inline snapshot. That value is environment-dependent, so the test passed only on a main push and failed on every non-main PR — reddening the 🧪 Test check across the whole open-PR fleet (I hit it on an unrelated workflow PR, #1429).

Root cause

The CLI resolves the branch at runtime (packages/cli/src/util/git/git-remote-info.mts → gitBranch):

1. git symbolic-ref --short HEAD — the current branch when on one (local / worktree runs).
2. On detached HEAD (CI checkouts): GITHUB_HEAD_REF (PR head branch), else GITHUB_REF_NAME when the ref is a branch.
3. Fallback: short commit hash.

So the dry-run details print whatever branch the test runs on — "main" on a main push, the PR head branch on a PR build, the local feature branch from a worktree. The snapshot only matched case 1-on-main.

Before/after proof (run on a non-main branch)

On branch fix/cmd-ci-branch-snapshot, the raw built CLI emits the feature branch (would fail the old "main" snapshot):

$ node dist/cli.js ci --dry-run --config '{"apiToken":"fakeToken"}'
    branchName: "fix/cmd-ci-branch-snapshot"

With the scrub in place, the integration test passes on that same non-main branch:

$ pnpm exec vitest run --config vitest.integration.config.mts test/integration/cli/cmd-ci.test.mts
 ✓ test/integration/cli/cmd-ci.test.mts (2 tests)
     ✓ should support --help
     ✓ should require args with just dry-run
 Test Files  1 passed (1)

Fix

Handled at the snapshot-scrubber boundary (packages/cli/test/util/scrub-snapshot-data.mts), alongside the existing [PROJECT] / [TIMESTAMP] / [UUID] / [IP] normalizations — the same place volatile, environment-specific values are already pinned:

• scrubSnapshotData now replaces the human-readable branchName: "…" details line with branchName: "[BRANCH]" (new branches option, default true). The regex only matches the details form (unquoted key + : "), not JSON output ("branchName":"…"), so machine-readable snapshots are untouched.
• Updated the one snapshot that pinned it (branchName: "[BRANCH]").

No real coverage lost: branch-resolution behavior stays asserted by the unit specs that mock gitBranch (handle-ci / cmd-ci unit tests assert develop / feature-branch / (default) with deterministic inputs). This test only verifies the dry-run details block renders — which it still does.

Testing

• Added 5 scrubber unit tests (main / slashed feature branch / detached-HEAD hash / JSON-form left intact / disabled). scrub-snapshot-data.test.mts: 35/35 pass.
• cmd-ci integration test: 2/2 pass on a non-main branch (was red before — see proof above).
• oxlint clean on all changed files; tsgo --noEmit reports zero errors in changed files (the pre-existing TS4111 errors in output-purls-shallow-score.mts are on main, untouched here).

Impact

Unblocks the 🧪 Test check for all non-main socket-cli PRs.

---

Note

Low Risk
Test-only changes to snapshot scrubbing; no CLI runtime or branch-resolution logic is modified.

Overview
Fixes flaky socket ci integration snapshots that assumed branchName: "main" while the CLI prints the ambient git/CI branch.

scrubSnapshotData now normalizes human-readable dry-run details lines (branchName: "…") to branchName: "[BRANCH]" via a new branches option (default on). JSON-style "branchName":"…" output is left unchanged. The cmd-ci dry-run inline snapshot expects [BRANCH], and five scrubber unit tests cover main, feature branches, detached HEAD hashes, JSON passthrough, and opt-out.

^{Reviewed by Cursor Bugbot for commit 46b82fe. Configure here.}

[John-David Dalton (jdalton)]

CI confirms the fix: 🧪 Test passes on this non-main PR — the exact check that was red on every non-main socket-cli PR before this change.

The remaining red 🔎 Check (lint) is pre-existing and unrelated: all findings are in scripts/repo/stage-publish-cli-exe.mts / src/commands/package/output-purls-shallow-score.mts, files this PR does not touch (it fails on main too). Cursor Bugbot and all Socket Security checks pass.