fix(ci): green the test/clippy jobs broken by the sweep

Three CI-blocking fixes surfaced by the failing checks (clippy + test on
all OSes + coverage + test-release):

- clippy: `map_or(true, ..)` -> `is_none_or(..)` in manifest/schema.rs
  (clippy 1.93 `unnecessary_map_or`, denied via `-D warnings`).

- rollback_dispatch_branch_golang: the sweep added a project-local go
  redirect rollback backend. In local mode go rolls back by dropping the
  `replace` redirect and leaves the module cache pristine, so it never
  restores cache bytes (verified: local mode reports success without
  touching the file; global mode genuinely restores). The dispatch test's
  byte-restore contract only holds on the in-place/global path — the go
  analog of the cargo test's `vendor/` in-place layout — so drive that one
  fixture in `--global` mode.

- output_helpers_e2e: the sweep's severity-colour-inversion fix flipped
  critical->bright-red(91)/high->red(31) and updated the in-crate unit
  tests, but this integration file still asserted the old swapped codes.
  cargo test is fail-fast, so it aborted on the golang failure before ever
  reaching this binary in CI; surfaced via a local `--no-fail-fast` run.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/tests/ecosystem_dispatch_e2e.rs

@@ -428,9 +428,22 @@ struct RollbackFixture {
     verify_file: PathBuf,
     /// Extra env vars the crawler needs (cache locations, experimental gates).
     envs: Vec<(String, String)>,
-}
-
-fn run_rollback(cwd: &Path, ecosystem: &str, envs: &[(String, String)]) -> (i32, Value) {
+    /// Run the rollback in `--global` mode. Required for ecosystems whose
+    /// project-local backend is a *redirect* (golang): in local mode the
+    /// patched bytes live in a project-local copy and the module cache is left
+    /// pristine, so rollback drops the redirect rather than restoring the cache
+    /// file in place. Byte-restore — the contract `assert_rollback_restored`
+    /// verifies — only happens on the global/in-place path (the analog of
+    /// cargo's `vendor/` in-place layout). Defaults to local mode.
+    global: bool,
+}
+
+fn run_rollback(
+    cwd: &Path,
+    ecosystem: &str,
+    global: bool,
+    envs: &[(String, String)],
+) -> (i32, Value) {
     let mut cmd = Command::new(binary());
     cmd.args([
         "rollback",
@@ -439,9 +452,11 @@ fn run_rollback(cwd: &Path, ecosystem: &str, envs: &[(String, String)]) -> (i32,
         "--ecosystems",
         ecosystem,
         "--silent",
-    ])
-    .current_dir(cwd)
-    .env_remove("SOCKET_API_TOKEN");
+    ]);
+    if global {
+        cmd.arg("--global");
+    }
+    cmd.current_dir(cwd).env_remove("SOCKET_API_TOKEN");
     for (k, v) in envs {
         cmd.env(k, v);
     }
@@ -455,7 +470,7 @@ fn run_rollback(cwd: &Path, ecosystem: &str, envs: &[(String, String)]) -> (i32,
 /// Drive a genuine rollback for `fixture` and assert it discovered the
 /// package, restored the file, and reported success for the exact PURL.
 fn assert_rollback_restored(cwd: &Path, ecosystem: &str, fixture: &RollbackFixture) {
-    let (code, env) = run_rollback(cwd, ecosystem, &fixture.envs);
+    let (code, env) = run_rollback(cwd, ecosystem, fixture.global, &fixture.envs);
     assert_eq!(
         code, 0,
         "rollback --ecosystems={ecosystem}: expected exit 0; env={env}"
@@ -524,7 +539,7 @@ fn assert_rollback_restored(cwd: &Path, ecosystem: &str, fixture: &RollbackFixtu
 /// file is left untouched (still PATCHED). Mirrors `assert_apply_not_dispatched`
 /// for the separate `find_packages_for_rollback` code path.
 fn assert_rollback_not_dispatched(cwd: &Path, ecosystem: &str, fixture: &RollbackFixture) {
-    let (code, env) = run_rollback(cwd, ecosystem, &fixture.envs);
+    let (code, env) = run_rollback(cwd, ecosystem, fixture.global, &fixture.envs);
     assert_eq!(
         code, 0,
         "rollback --ecosystems={ecosystem}: out-of-scope rollback should be a clean no-op (exit 0); env={env}"
@@ -575,6 +590,7 @@ fn fixture_npm(root: &Path) -> RollbackFixture {
         purl: purl.to_string(),
         verify_file,
         envs: vec![],
+        global: false,
     }
 }
 
@@ -605,6 +621,7 @@ fn fixture_pypi(root: &Path) -> RollbackFixture {
         purl: purl.to_string(),
         verify_file,
         envs: vec![],
+        global: false,
     }
 }
 
@@ -626,6 +643,7 @@ fn fixture_gem(root: &Path) -> RollbackFixture {
         purl: purl.to_string(),
         verify_file,
         envs: vec![],
+        global: false,
     }
 }
 
@@ -694,6 +712,7 @@ fn rollback_dispatch_branch_cargo() {
         purl: purl.to_string(),
         verify_file,
         envs: vec![],
+        global: false,
     };
     assert_rollback_restored(root, "cargo", &fixture);
 }
@@ -716,6 +735,11 @@ fn rollback_dispatch_branch_golang() {
         purl: purl.to_string(),
         verify_file,
         envs: vec![("GOMODCACHE".to_string(), cache.display().to_string())],
+        // Local-go rolls back by dropping the project-local `replace` redirect
+        // and leaves the module cache pristine, so it never restores cache
+        // bytes. Drive the global/in-place path to exercise byte-restore — the
+        // go analog of the cargo test's `vendor/` in-place layout.
+        global: true,
     };
     assert_rollback_restored(root, "golang", &fixture);
 }
@@ -750,6 +774,7 @@ fn rollback_dispatch_branch_maven() {
             ("MAVEN_REPO_LOCAL".to_string(), repo.display().to_string()),
             ("SOCKET_EXPERIMENTAL_MAVEN".to_string(), "1".to_string()),
         ],
+        global: false,
     };
     assert_rollback_restored(root, "maven", &fixture);
 }
@@ -778,6 +803,7 @@ fn rollback_dispatch_branch_composer() {
         purl: purl.to_string(),
         verify_file,
         envs: vec![],
+        global: false,
     };
     assert_rollback_restored(root, "composer", &fixture);
 }
@@ -805,6 +831,7 @@ fn rollback_dispatch_branch_nuget() {
         purl: purl.to_string(),
         verify_file,
         envs: vec![("SOCKET_EXPERIMENTAL_NUGET".to_string(), "1".to_string())],
+        global: false,
     };
     assert_rollback_restored(root, "nuget", &fixture);
 }

crates/socket-patch-cli/tests/output_helpers_e2e.rs

@@ -18,14 +18,16 @@ fn format_severity_no_color_returns_input_verbatim() {
 }
 
 #[test]
-fn format_severity_critical_wraps_in_red() {
-    // Exact envelope: red open + verbatim text + reset, nothing else.
-    assert_eq!(format_severity("critical", true), "\x1b[31mcritical\x1b[0m");
+fn format_severity_critical_wraps_in_bright_red() {
+    // Exact envelope: bright-red open + verbatim text + reset, nothing else.
+    // Critical is the most prominent colour (bright red, 91) — strictly more
+    // prominent than high (plain red, 31).
+    assert_eq!(format_severity("critical", true), "\x1b[91mcritical\x1b[0m");
 }
 
 #[test]
-fn format_severity_high_wraps_in_bright_red() {
-    assert_eq!(format_severity("high", true), "\x1b[91mhigh\x1b[0m");
+fn format_severity_high_wraps_in_red() {
+    assert_eq!(format_severity("high", true), "\x1b[31mhigh\x1b[0m");
 }
 
 #[test]
@@ -52,8 +54,8 @@ fn format_severity_case_insensitive() {
     // text must be the caller's verbatim, original-case string (production
     // wraps `{s}`, not the lowercased key). Exact-equality catches both a
     // miscoloured branch and any impl that lowercases the rendered text.
-    assert_eq!(format_severity("CRITICAL", true), "\x1b[31mCRITICAL\x1b[0m");
-    assert_eq!(format_severity("High", true), "\x1b[91mHigh\x1b[0m");
+    assert_eq!(format_severity("CRITICAL", true), "\x1b[91mCRITICAL\x1b[0m");
+    assert_eq!(format_severity("High", true), "\x1b[31mHigh\x1b[0m");
     assert_eq!(format_severity("MEDIUM", true), "\x1b[33mMEDIUM\x1b[0m");
     assert_eq!(format_severity("Low", true), "\x1b[36mLow\x1b[0m");
 }

crates/socket-patch-core/src/manifest/schema.rs

@@ -83,7 +83,7 @@ impl SetupConfig {
 /// on-disk `.socket/manifest.json` byte-stable regardless of which in-memory
 /// representation produced it.
 fn setup_is_absent(setup: &Option<SetupConfig>) -> bool {
-    setup.as_ref().map_or(true, SetupConfig::is_empty)
+    setup.as_ref().is_none_or(SetupConfig::is_empty)
 }
 
 /// The top-level patch manifest structure.