fix(outdated): use virtual-path basename for monorepo tag pattern matching (#1893)

* fix(outdated): use virtual-path basename for monorepo tag pattern matching

PR #1504 added monorepo tag support ({name}_v{version}), but
_package_basename() only considered repo_url. For virtual
subdirectory packages (e.g. path: packages/agent-dev-workflow),
the repo basename (smo-architektur.ai) did not match the tag prefix
(agent-dev-workflow), causing apm outdated to report unknown.

This fix derives the basename from virtual_path for subdirectory
packages, aligning with the same logic already used in
revision_pins.py.

Resolves the unknown status seen for monorepo virtual deps.

* fix(outdated): avoid MagicMock truthiness in _package_basename

Existing unit tests build deps with bare MagicMock() and never
set is_virtual. MagicMock returns a new (truthy) MagicMock for
unknown attributes, so the new virtual-path branch fires and
returns a MagicMock as package_name. That flows into re.compile
and raises TypeError.

Change `if dep.is_virtual` to `if dep.is_virtual is True` so
only real LockedDependency instances with is_virtual=True enter
the branch.

* fix(outdated): address review-panel feedback for PR #1893

- Revert 'is True' identity guard; fix test helpers to set is_virtual=False.
- Delegate virtual-subdir basename extraction to revision_pins._package_name
  to avoid silent divergence between outdated and update.
- Pass already-built dep_ref into _package_basename to avoid double-allocation.
- Add parametrized unit tests for trailing-slash / nested virtual_path variants.
- Add CHANGELOG entry under [Unreleased] > Fixed.

* fix(outdated): fold review feedback for PR 1893

Restore the release changelog entries that the branch had dropped, move the new outdated fix note back under Unreleased, and promote the revision-pin package-name helper before reusing it from outdated.py.

Addresses apm-review-panel follow-ups for PR #1893.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Sergio Sisternes <sergio_sisternes@epam.com>
Co-authored-by: danielmeppiel <danielmeppiel@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Daniel Meppiel <51440732+danielmeppiel@users.noreply.github.com>

Author: 4 people

CHANGELOG.md

@@ -9,6 +9,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- `apm outdated` tag-pattern matching for monorepo virtual subdirectory
+  dependencies now derives the `{name}` segment from the `virtual_path`
+  basename (e.g., `packages/my-pkg` -> `my-pkg`), aligning with `apm update`
+  behavior. (by @kevinbeier-enbw; closes #1893) (#1893)
 - Skipped startup update checks for unknown `apm` commands and bare help
   invocations so invalid CLI input fails without update-check latency. (by
   @maro114510) (#1541)

src/apm_cli/commands/outdated.py

@@ -13,6 +13,7 @@
 
 import click
 
+from ..deps.lockfile import LockedDependency
 from ..deps.outdated_row import OutdatedRow
 from ..deps.revision_pins import (
     RevisionPinResolutionError,
@@ -21,6 +22,10 @@
     find_latest_annotated_tag,
     is_full_revision_pin,
 )
+from ..deps.revision_pins import (
+    package_name as revision_pin_package_name,
+)
+from ..models.dependency.reference import DependencyReference
 from ..models.dependency.types import RemoteRef
 
 logger = logging.getLogger(__name__)
@@ -50,10 +55,17 @@ def _strip_v(ref: str) -> str:
     return ref[1:] if ref and ref.startswith("v") else (ref or "")
 
 
-def _package_basename(dep) -> str:
+def _package_basename(dep: LockedDependency, dep_ref: DependencyReference | None = None) -> str:
     """Return the display name used in ``{name}`` tag patterns."""
     if dep.marketplace_plugin_name:
         return dep.marketplace_plugin_name
+    # For virtual subdirectory packages, derive the name from the virtual path
+    # (e.g. "packages/agent-dev-workflow" -> "agent-dev-workflow").
+    if dep.is_virtual and dep.virtual_path:
+        if dep_ref is None:
+            dep_ref = dep.to_dependency_ref()
+        if dep_ref.is_virtual_subdirectory():
+            return revision_pin_package_name(dep_ref)
     repo = dep.repo_url or ""
     if not repo:
         return ""
@@ -294,7 +306,7 @@ def _check_one_dep(dep, downloader, verbose, registry_ctx=None):
             package=package_name, current=current_ref or "(none)", latest="-", status="unknown"
         )
 
-    package_basename = _package_basename(dep)
+    package_basename = _package_basename(dep, dep_ref=dep_ref)
     revision_pin_row = _check_revision_pin_ref(
         current_ref=current_ref,
         package_name=package_name,

src/apm_cli/deps/revision_pins.py

@@ -61,7 +61,7 @@ def abbreviate_sha(sha: str | None) -> str:
     return (sha or "")[:_SHA_DISPLAY_LEN]
 
 
-def _package_name(dep_ref: DependencyReference) -> str:
+def package_name(dep_ref: DependencyReference) -> str:
     """Return the tag-pattern package name for *dep_ref*."""
     if dep_ref.is_virtual_subdirectory() and dep_ref.virtual_path:
         return dep_ref.virtual_path.rstrip("/").rsplit("/", 1)[-1]
@@ -141,7 +141,7 @@ def _resolve_one(dep_ref: DependencyReference) -> RevisionPinUpdate | None:
         dep_key = dep_ref.get_unique_key()
         old_sha = (dep_ref.reference or "").strip().lower()
         remote_refs = downloader.list_remote_tag_refs(dep_ref)
-        latest = find_latest_annotated_tag(remote_refs, package_name=_package_name(dep_ref))
+        latest = find_latest_annotated_tag(remote_refs, package_name=package_name(dep_ref))
         latest_sha = latest.commit_sha.strip().lower()
         if not is_full_revision_pin(latest_sha):
             raise RevisionPinResolutionError(

tests/unit/test_outdated_command.py

@@ -6,7 +6,7 @@
 from pathlib import Path
 from unittest.mock import MagicMock, patch
 
-import pytest  # noqa: F401
+import pytest
 from click.testing import CliRunner
 
 from apm_cli.cli import cli
@@ -908,6 +908,51 @@ def test_virtual_dep_processed_normally(
             # Remote refs were fetched -- virtual deps are NOT silently skipped
             mock_downloader.list_remote_refs.assert_called_once()
 
+    @patch(_PATCH_AUTH)
+    @patch(_PATCH_DOWNLOADER)
+    @patch(_PATCH_MIGRATE)
+    @patch(_PATCH_GET_LOCKFILE_PATH)
+    @patch(_PATCH_GET_APM_DIR)
+    @patch(_PATCH_LOCKFILE)
+    def test_monorepo_virtual_subdir_tag_pattern_recognized(
+        self,
+        mock_lf_cls,
+        mock_get_apm_dir,
+        mock_get_path,
+        mock_migrate,
+        mock_dl_cls,
+        mock_auth,
+    ):
+        """Monorepo tags using virtual-path basename are parsed, not marked unknown."""
+        with self._chdir_tmp() as tmp:
+            mock_get_apm_dir.return_value = tmp
+            mock_get_path.return_value = tmp / "apm.lock.yaml"
+
+            virtual_dep = LockedDependency(
+                repo_url="org/monorepo",
+                resolved_ref="agent-dev-workflow_v0.0.20260624",
+                resolved_commit="d2b0ad19fd792cbb12e0f653b65607b8f9c95d4e",
+                is_virtual=True,
+                virtual_path="packages/agent-dev-workflow",
+            )
+            deps = {"org/monorepo/packages/agent-dev-workflow": virtual_dep}
+            mock_lf_cls.read.return_value = _make_lockfile(deps)
+
+            mock_downloader = MagicMock()
+            mock_downloader.list_remote_refs.return_value = [
+                _remote_tag("agent-dev-workflow_v0.0.20260624"),
+                _remote_tag("agent-dev-workflow_v0.0.20260625"),
+            ]
+            mock_dl_cls.return_value = mock_downloader
+
+            result = self.runner.invoke(cli, ["outdated"])
+
+            assert result.exit_code == 0
+            assert "unknown" not in result.output.lower()
+            assert "outdated" in result.output.lower()
+            # Latest tag is shown (may be truncated in narrow tables)
+            assert "agent-dev-" in result.output
+
     # --- Dev dependency visibility ---
 
     @patch(_PATCH_AUTH)
@@ -1221,3 +1266,28 @@ def test_ado_dep_builds_correct_reference(
             assert result.exit_code == 0
             # Verify list_remote_refs was called (dep was not silently skipped)
             mock_downloader.list_remote_refs.assert_called_once()
+
+
+class TestPackageBasename:
+    """Direct unit tests for _package_basename edge cases."""
+
+    @pytest.mark.parametrize(
+        "virtual_path,expected",
+        [
+            ("packages/agent-dev-workflow", "agent-dev-workflow"),
+            ("packages/agent-dev-workflow/", "agent-dev-workflow"),
+            ("packages/deep/nested/pkg", "pkg"),
+            ("pkg", "pkg"),
+        ],
+    )
+    def test_virtual_subdir_basename_variants(self, virtual_path, expected):
+        """Trailing slashes, deep nesting, and simple names all resolve correctly."""
+        dep = LockedDependency(
+            repo_url="org/monorepo",
+            resolved_ref="v1.0.0",
+            is_virtual=True,
+            virtual_path=virtual_path,
+        )
+        from apm_cli.commands.outdated import _package_basename
+
+        assert _package_basename(dep) == expected

tests/unit/test_outdated_marketplace_detection.py

@@ -47,6 +47,8 @@ def _make_dep(
     dep.registry_prefix = registry_prefix
     dep.discovered_via = discovered_via
     dep.marketplace_plugin_name = marketplace_plugin_name
+    dep.is_virtual = False
+    dep.virtual_path = None
     return dep
 
 

tests/unit/test_outdated_phase3w5.py

@@ -47,6 +47,8 @@ def _make_dep(
     dep.registry_prefix = registry_prefix
     dep.discovered_via = discovered_via
     dep.marketplace_plugin_name = marketplace_plugin_name
+    dep.is_virtual = False
+    dep.virtual_path = None
     return dep