fix(mergedeep): preserve top-level array diff shapes

[decyjphr]

Comparing a repository's first ruleset against an empty target returns index-keyed additions and omits deletions, producing inconsistent dry-run JSON and reporting. This adapts the missing behavior from #1030 to yadhav/fix-recent-issues, including the review concern about inconsistent empty change buckets.

Changes

• Return array-shaped additions, modifications, and deletions for top-level array comparisons, including empty-target and no-change paths.
• Include deletions in the empty-target object result, preserve recursive accumulator references, and skip unsafe __proto__/constructor keys when copying object additions.
• Unwrap only actual top-level arrays, preserving a user-defined __array property on object sources.
• Add 34 regression cases covering exact result shapes, nested arrays, immutability, and first/subsequent ruleset NOP output through check-run and PR-comment rendering.

Existing identity matching, order-insensitive comparison, externally defined overrides, deletion behavior, and hasChanges semantics are preserved. In particular, an undefined/null target with an empty array still reports hasChanges: true; two empty arrays report false.

Validation

Using Node 22.12.0:

• Targeted comparison/rulesets/branches/reporting suites: 131 passed, 2 skipped. The original baseline had 97 passed and 2 skipped; the final tests against the unchanged base implementation produced 32 failures.
• npm run test:unit -- --runInBand --silent: 548 passed, 12 skipped across 24 passing and 2 skipped suites.
• ESLint passes for the production change and reporting tests. Diagnostics in the two existing test files are unchanged from the base: 43 errors and 6 warnings. git diff --check passes.
• npm run test:integration -- --runInBand --silent: blocked by the reproduced baseline Probot ESM loading error (Unexpected token 'export'); all 7 suites fail before executing tests.
• Live smoke not run: read-only preflight found pre-existing, unowned phase17 branches in the shared test environment. Filtered runs still perform destructive shared setup/teardown, so those resources were left untouched. No smoke resources were created or deleted.

Based on ee288d36b38484883ca0551457e5a8feee061d43; no wholesale merge from main-enterprise.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation and regression coverage address the requested diff-shape and reporting behavior.

Review effort: Lite
Findings: None

What changed in this PR

This pull request normalizes top-level array diff shapes in MergeDeep, improving first-ruleset dry-run and reporting consistency.

Changes:

• Preserve array-shaped additions, modifications, and deletions.
• Handle empty targets, recursive accumulators, and unsafe keys safely.
• Add regression coverage for merge and reporting paths.

File	Description
test/​unit/​lib/​settings-results.test.js	Verifies check-run and PR reporting output.
test/​unit/​lib/​plugins/​rulesets.test.js	Verifies first-ruleset NOP output.
test/​unit/​lib/​mergeDeep.test.js	Covers comparison edge cases and immutability.
lib/​mergeDeep.js	Implements normalized diff shapes and safe copying.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.