test(github): follow shared guard membership helper

vincentkoc · vincentkoc · commit 625e971b172a · 2026-06-20T00:45:43.000+02:00
diff --git a/test/scripts/security-sensitive-guard-workflow.test.ts b/test/scripts/security-sensitive-guard-workflow.test.ts
@@ -136,14 +136,16 @@ describe("security-sensitive guard workflow", () => {
   it("uses a dedicated checked-in script and detects the intended file surfaces", () => {
     const workflow = readFileSync(WORKFLOW, "utf8");
     const script = readFileSync("scripts/github/security-sensitive-guard.mjs", "utf8");
+    const sharedScript = readFileSync("scripts/github/guard-shared.mjs", "utf8");
+    const guardSources = `${script}\n${sharedScript}`;
 
     expect(workflow).toContain("scripts/github/security-sensitive-guard.mjs");
     expect(script).toContain('"security-sensitive-changed"');
     expect(script).toContain('path: ".gitignore"');
     expect(script).toContain(".env");
     expect(script).toContain("/allow-security-sensitive-change");
     expect(script).toContain("openclaw-secops");
-    expect(script).toContain("/memberships/");
+    expect(guardSources).toContain("/memberships/");
     expect(script).toContain("A later push requires a fresh approval.");
     expect(script).toContain("process.exitCode = 1");
   });
