From fb7445eaa3a36b206c6e7dd03563e1e5fcd2bfa2 Mon Sep 17 00:00:00 2001
From: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
Date: Fri, 28 Aug 2026 17:29:04 -0300
Subject: [PATCH] test(check): escape the runs-on fixture with JSON.stringify,
 not a quote-only replace

CodeQL js/incomplete-sanitization (#888): the hand-rolled replace only escaped
double quotes, so a backslash in the fixture would have produced a malformed YAML
scalar. JSON.stringify covers every escape the double-quoted YAML scalar needs.
---
 tests/unit/check-workflows-provenance-runner.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/unit/check-workflows-provenance-runner.test.ts b/tests/unit/check-workflows-provenance-runner.test.ts
index 826327fdbd..d7edb51cec 100644
--- a/tests/unit/check-workflows-provenance-runner.test.ts
+++ b/tests/unit/check-workflows-provenance-runner.test.ts
@@ -59,7 +59,7 @@ test("classifyRunsOn: hosted labels are hosted, opaque expressions are unknown (
 test("flags --provenance inside a job routed to the self-hosted pool", () => {
   const found = findProvenanceOnSelfHosted(
     workflow(
-      `"${VPS_EXPR.replace(/"/g, '\\"')}"`,
+      JSON.stringify(VPS_EXPR),
       'npm stage publish --provenance --access public --tag "$TAG"'
     ),
     "npm-publish.yml"