security_watch: a GitHub Actions advisory is not listed; an empty fix with a closed range reads 'after X' (R-1310 part; test W9, red first)

scripts/test_security_watch.py

@@ -13,9 +13,11 @@ What is pinned, each by its consequence (the mail or the class), not by its mech
   W7  the weekly summary on Monday only (or when the last one is 8+ days old); a seed mails nothing and says what it
       would have mailed
   W8  the inventory: an image with no upstream line refuses (the gate), a gap needs a reason, the grammar
+  W9  a GitHub Actions advisory is not listed; an empty fix with a range ending at X reads „after X", not „no fix"
 Red-proofs (2026-10-26): W5 with the `k not in known` test removed (every night mails) -> W5 fails; W6 with the streak
 threshold at 1 -> W6 fails; W2 with FEED_DAYS check removed -> W2's old-item case fails; W4 with SourceError swallowed
--> W4 fails.
+-> W4 fails. W9 (2026-10-27, R-1310) was seen failing before its two rules existed (2 of 4 checks red, the two
+controls green).
 """
 import datetime
 import json
@@ -300,7 +302,29 @@ def t_inventory():
         shutil.rmtree(ws, ignore_errors=True)
 
 
+def t_ranges():
+    """W9 (R-1310, measured 2026-10-27): two shapes a hand read of all 38 flagged pins found wrong."""
+    print("-- W9: notices that are not about the product; an empty fix with a closed range")
+    ci = {"vulnerabilities": [{"package": {"ecosystem": "actions", "name": "home-assistant/actions/helpers/version"},
+                               "vulnerable_version_range": "< September 5, 2023", "patched_versions": "September 5, 2023"}]}
+    a, _ = w.ghsa_affects(ci, w.version_of("2026.9.4"), "home-assistant/core")
+    check("W9 a GitHub Actions advisory (the project's CI) is not about the image -> not listed", a is False, a)
+    prod = {"vulnerabilities": [{"package": {"ecosystem": "go", "name": "code.vikunja.io/api"},
+                                 "vulnerable_version_range": ">= 2.3.0, <= 2.6.0", "patched_versions": ""}]}
+    a, fixed = w.ghsa_affects(prod, w.version_of("2.6.0"), "go-vikunja/vikunja")
+    check("W9 an empty fix with a range ending at 2.6.0 -> ADVISORY, fixed after 2.6.0 (not 'no fixed version')",
+          a is True and "after 2.6.0" in fixed and "no fixed version" not in fixed, (a, fixed))
+    a, fixed = w.ghsa_affects(prod, w.version_of("2.7.0"), "go-vikunja/vikunja")
+    check("W9 negative: the same notice at 2.7.0 -> not listed", a is False, (a, fixed))
+    open_ = {"vulnerabilities": [{"package": {"ecosystem": "go", "name": "x"},
+                                  "vulnerable_version_range": ">= 2.3.0", "patched_versions": ""}]}
+    a, fixed = w.ghsa_affects(open_, w.version_of("2.6.0"), "o/r")
+    check("W9 control: an open range with no fix still says 'no fixed version named yet'",
+          a is True and fixed == "no fixed version named yet", (a, fixed))
+
+
 def main():
+    t_ranges()
     t_classes()
     t_memory()
     t_inventory()