fix(mergedeep): converge identifier-less bypass actors

[decyjphr]

GitHub ignores actor_id for OrganizationAdmin and DeployKey, but the target's comparison logic still reports drift for some omitted, null, and concrete ID combinations. Its broad null-ID exception can also hide meaningful changes for actors that require IDs.

Approach

• Adapt fix(mergedeep): handle null actor_id in bypass actor comparison #1035 to the target's existing identity and stable-comparison logic rather than replacing it: identify these two bypass actor types by actor_type and ignore only their meaningless IDs.
• Use the same identity in reported modifications, preserving real bypass_mode and ID-bearing actor changes. Keep NAME_FIELDS, merge-layer matching, non-actor identity precedence, and input configurations unchanged.
• Add regression and ruleset-consumer coverage, update the sample configuration, and add focused smoke phase 19 for apply, exact actor state, NOP convergence, and no redundant writes.

Source audit and scope

Based on yadhav/fix-recent-issues at 8135a2e87ad1de32adf2d5b5f371ca002ffb0192. All six original #1035 scenarios already passed on that base, but the normalization and related comparison gaps above remained.

Both source commits were selectively adapted into e4b5f0060da1b3ef1bdab42e4d1e62d6caf73169:

• 0b45e69c73a4deafeac40610d23760a7bc71827e: null-ID comparison fix and sample configuration.
• 2e5ac4ade0095dae18d33fcc4517f40e8973a1b4: distinct null-ID actor regression coverage.

The only additional commit is d18ef76d9e28391cb4975c3f7e7b72359b037c1d, which isolates the smoke fixture from unrelated default drift. No source ancestry or unrelated changes were merged. Related to #1034.

Validation

Node 22.12.0 / npm 10.9.0, selected with nvm use 22.

• npm run test:unit -- --runInBand: 604 passed, 12 skipped.
• Focused mergeDeep, mergeArrayBy, and rulesets suites: 151 passed. Before the runtime fix, 28 added regressions failed.
• PORT=3304 SMOKE_VERBOSE=1 LOG_LEVEL=info node smoke-test.js --phase 1,19: 33 passed, 0 failed; setup, prerequisite phase 1, all phase 19 cases, and teardown completed. Whole-check NOP assertions and unchanged ruleset IDs/timestamps verify convergence.
• The first smoke attempt exposed unrelated inherited fixture drift and an API-rejected role ID. The isolated retry retains strong assertions and exercises removal of a known-valid role instead.
• Independent cleanup matched the original resource inventory, preserving unowned branches and the admin policy; the server stopped and the shared reservation was released.

Existing limitations were reproduced on the untouched base: all seven integration suites fail before test execution on Probot ESM/Jest Unexpected token 'export'; existing test and smoke lint findings are unchanged. Runtime lint is clean.

[Copilot]

Copilot review overview

🟡 Changes recommended

Optional bypass modes and centralized actor merging still produce incorrect convergence behavior.

Review effort: Balanced
Findings: 1

Open (1)

• Align actor identity with centralized bypassActorKey · New

What changed in this PR

Fixes ruleset convergence for identifier-less bypass actors while preserving meaningful actor changes.

Changes:

• Compares OrganizationAdmin and DeployKey actors by type.
• Adds unit, plugin, and smoke-test coverage.
• Updates sample configuration and smoke-test documentation.

File	Description
lib/​mergeDeep.js	Normalizes bypass actor identity and comparison.
test/​unit/​lib/​mergeDeep.test.js	Adds comparison regressions.
test/​unit/​lib/​plugins/​rulesets.test.js	Tests ruleset synchronization.
smoke-test.js	Adds convergence smoke phase 19.
README.md	Documents the new smoke phase.
docs/​sample-settings/​settings.yml	Documents identifier-less actor configuration.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Valid actors omitting optional bypass_mode still fail identifier-less matching and can produce perpetual drift.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Align actor identity with centralized bypassActorKey