fix(audit): fail on a severity the wrapper cannot rank

Severity is ranked by index into a fixed list, and an unrecognized string yields
-1, which sorts below every configured threshold. A renamed or newly added bun
severity therefore skips every advisory carrying it and the job reports a clean
tree, which is the failure the wrapper exists to prevent rather than one it can
absorb quietly.

Author: BridgeAR

scripts/audit.js

@@ -78,6 +78,11 @@ function runAudit (directory) {
       // match, so surface it instead.
       if (!advisory?.url) throw new Error(`Advisory for ${packageName} in '${directory}' has no URL to identify it.`)
       const id = ghsaId(advisory.url)
+      // An unrecognized severity would rank below every threshold and skip the advisory silently, so a renamed or
+      // added bun severity has to fail here rather than turn the whole job green.
+      if (!SEVERITIES.includes(advisory.severity)) {
+        throw new Error(`Advisory ${id} in '${directory}' reports unknown severity '${advisory.severity}'.`)
+      }
       advisories.set(id, { id, package: packageName, severity: advisory.severity, title: advisory.title })
     }
   }

scripts/test/audit.spec.js

@@ -51,6 +51,16 @@ describe('scripts/audit.js', () => {
     assert.match(result.stderr, /unaccepted high advisory GHSA-bbbb-bbbb-bbbb in some-package/)
   })
 
+  it('fails on a severity it cannot rank instead of skipping the advisory', () => {
+    const result = runAudit({
+      report: { 'some-package': [advisory('GHSA-ffff-ffff-ffff', 'medium')] },
+      allow: [],
+    })
+
+    assert.strictEqual(result.status, 1)
+    assert.match(result.stderr, /GHSA-ffff-ffff-ffff .* reports unknown severity 'medium'/)
+  })
+
   it('ignores an advisory below the directory threshold', () => {
     const result = runAudit({
       report: { 'some-package': [advisory('GHSA-cccc-cccc-cccc', 'moderate')] },