refactor: make packageIsVerified() actually short-circuit

src/helpers/package.ts

@@ -244,14 +244,9 @@ export function packageYamlToJs(pkgYaml: string) {
 
 export function packageIsVerified(slug: string, pkgVersion: PackageVersion) {
   const org: string = slug.split('/')[0];
-  let verified: boolean = true;
-  pkgVersion.files.forEach(file => {
+  return pkgVersion.files.every(file => {
     const url: string = file.url.toLowerCase();
     const root: string = url.startsWith('https://github.com/') ? 'https://github.com/' + org + '/' : `https://${org}.`;
-    if (!url.startsWith(root)) {
-      verified = false;
-      return;
-    }
+    return url.startsWith(root);
   });
-  return verified;
 }

tests/helpers/package.test.ts

@@ -2,6 +2,7 @@ import { expect, test } from 'vitest';
 import {
   packageCompatibleFiles,
   packageDownloadsTotal,
+  packageIsVerified,
   packageRecommendations,
   packageVersionLatest,
   PackageVersionValidator,
@@ -138,6 +139,24 @@ test('Package compatible files returns empty when only unsupported formats exist
   expect(excludedResult).toHaveLength(0);
 });
 
+test('Package is verified when every file url matches the org', () => {
+  expect(packageIsVerified('surge-synthesizer/surge', PLUGIN)).toEqual(true);
+});
+
+test('Package is not verified when any file url does not match the org', () => {
+  const pluginWithForeignFile: PackageVersion = {
+    ...PLUGIN,
+    files: [
+      ...PLUGIN.files,
+      {
+        ...PLUGIN.files[0],
+        url: 'https://github.com/someone-else/unrelated/releases/download/1.0.0/file.deb',
+      },
+    ],
+  };
+  expect(packageIsVerified('surge-synthesizer/surge', pluginWithForeignFile)).toEqual(false);
+});
+
 test('Package compatible files respects exclusions when alternatives exist', () => {
   const bothFormatsPackage: PackageVersion = {
     ...PLUGIN,