test: fix multi_html_reporter tests for new interactive features

Fixed test failures caused by template enhancements:

1. Updated CSP assertion: 'script-src none' → 'script-src unsafe-inline'
2. Fixed mock_repository fixture to create valid .git directory
3. Added config=None parameter to Assessment fixtures
4. Adjusted attributes_total to match findings count (0)
5. Updated XSS prevention tests to allow legitimate <script> tags

All XSS tests still validate that injected payloads are properly escaped.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: jeremyeder

tests/unit/test_multi_html_reporter.py

@@ -28,14 +28,18 @@ def temp_html_file(tmp_path):
 
 
 @pytest.fixture
-def mock_repository():
+def mock_repository(tmp_path):
     """Create a mock repository for testing."""
+    # Create .git directory for valid repository
+    git_dir = tmp_path / ".git"
+    git_dir.mkdir()
+
     return Repository(
-        path=Path("/test/repo"),
+        path=tmp_path,
         name="test-repo",
+        url=None,
         branch="main",
         commit_hash="abc123def456",
-        primary_language="Python",
         languages={"Python": 10},
         total_files=100,
         total_lines=5000,
@@ -50,10 +54,11 @@ def mock_assessment(mock_repository):
         timestamp=datetime(2025, 1, 22, 14, 30, 22),
         overall_score=85.5,
         certification_level="Gold",
-        attributes_assessed=20,
-        attributes_not_assessed=5,
-        attributes_total=25,
+        attributes_assessed=0,
+        attributes_not_assessed=0,
+        attributes_total=0,
         findings=[],
+        config=None,
         duration_seconds=42.5,
     )
 
@@ -162,7 +167,7 @@ def test_generate_html_success(
 
         # Verify CSP header
         assert "Content-Security-Policy" in html_content
-        assert "script-src 'none'" in html_content
+        assert "script-src 'unsafe-inline'" in html_content
 
         # Verify content
         assert "Multi-Repository Assessment Report" in html_content
@@ -184,9 +189,10 @@ def test_generate_html_xss_prevention_repo_name(
 
         html_content = temp_html_file.read_text(encoding="utf-8")
 
-        # Verify script tag is escaped
-        assert "<script>" not in html_content
-        assert "&lt;script&gt;" in html_content or "script" not in html_content.lower()
+        # Verify XSS payload is escaped (not checking for legitimate script tags)
+        assert "alert('XSS')" not in html_content or "&lt;script&gt;alert('XSS')&lt;/script&gt;" in html_content
+        # Verify the escaped version exists
+        assert "&lt;script&gt;" in html_content
 
     def test_generate_html_xss_prevention_repo_url(
         self, template_dir, mock_batch_assessment, temp_html_file
@@ -226,9 +232,10 @@ def test_generate_html_xss_prevention_error_message(
 
         html_content = temp_html_file.read_text(encoding="utf-8")
 
-        # Verify img tag is escaped
-        assert "<img" not in html_content or "&lt;img" in html_content
-        assert "onerror=" not in html_content
+        # Verify XSS payload is escaped
+        assert "onerror=alert('XSS')" not in html_content
+        # Verify the escaped version exists
+        assert "&lt;img" in html_content
 
     def test_generate_html_autoescape_enabled(self, template_dir):
         """Test that Jinja2 autoescape is enabled."""
@@ -279,12 +286,16 @@ def test_generate_html_creates_parent_directory(self, template_dir, tmp_path):
         nested_path = tmp_path / "nested" / "dir" / "index.html"
 
         # Create minimal batch assessment
+        repo_path = tmp_path / "test_repo"
+        repo_path.mkdir()
+        (repo_path / ".git").mkdir()
+
         repo = Repository(
-            path=Path("/test"),
+            path=repo_path,
             name="test",
+            url=None,
             branch="main",
             commit_hash="abc123",
-            primary_language="Python",
             languages={},
             total_files=1,
             total_lines=1,
@@ -294,10 +305,11 @@ def test_generate_html_creates_parent_directory(self, template_dir, tmp_path):
             timestamp=datetime.now(),
             overall_score=50.0,
             certification_level="Bronze",
-            attributes_assessed=1,
+            attributes_assessed=0,
             attributes_not_assessed=0,
-            attributes_total=1,
+            attributes_total=0,
             findings=[],
+            config=None,
             duration_seconds=1.0,
         )
         result = RepositoryResult(