e1ec584b57
scripts/ci/check_agents_md_size.py (in scripts/check and lint.yml): root <= 12k, every AGENTS.md plus its ancestors <= 30k (the joined root->cwd block on a 128k window, minus the per-file labels), every area file <= _MAX_HINT_CHARS read from the source so the two cannot drift. On origin/main it reports the root and all 11 root-to-area chains over.
454 lines
21 KiB
Python
454 lines
21 KiB
Python
"""scripts/check runner, git hooks, CLI output modes and regex-rule scope, on real git repos.
|
|
|
|
Fixture repos carry a copy of this checkout's engine (scripts/check, scripts/code_health, the
|
|
guard scripts, pyproject's ruff pin) so the runner and the hooks execute exactly as they would
|
|
in a clone, against tiny trees that keep every check fast.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import os
|
|
import re
|
|
import shutil
|
|
import subprocess
|
|
import sys
|
|
from collections.abc import Mapping
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from scripts.code_health import cli
|
|
from scripts.code_health.config import ENFORCEMENT
|
|
|
|
REPO = Path(__file__).resolve().parents[2]
|
|
_GUARD_SCRIPTS = (
|
|
"scripts/check-windows-footguns.py", "scripts/check_bash_shebangs.py",
|
|
"scripts/check_no_tmp_literals.py", "scripts/check_config_yaml_writers.py",
|
|
"scripts/ci/check_os_marker_fakes.py", "scripts/check-case-collisions.py",
|
|
"scripts/ci/check_lazy_deps_imports.py", "scripts/ci/check_profile_archive_boundary.py",
|
|
"scripts/ci/check_agents_md_size.py",
|
|
)
|
|
_SUPPORT = ("scripts/ci/profile_scope_patterns.json", "agent/subdirectory_hints.py", *_GUARD_SCRIPTS)
|
|
_LEGACY = "def legacy(x):\n" + "".join(f" if x == {i}:\n return {i}\n" for i in range(21))
|
|
_GROWN = _LEGACY + " if x == 99:\n return 99\n"
|
|
_ENV_COPY = "import os\n\n\ndef child_env():\n env = os.environ.copy()\n return env\n"
|
|
# A violation of a rule that always blocks (PS-P05 is warning-only until replayed).
|
|
_SWALLOW = "def swallow():\n try:\n pass\n except Exception:\n pass\n"
|
|
_SWITCH = "scripts/code_health/config.py"
|
|
|
|
|
|
def _env() -> dict[str, str]:
|
|
"""The caller's env minus anything that would point git at another repo or config."""
|
|
env = {k: v for k, v in os.environ.items() if not k.startswith("GIT_")}
|
|
env.update(GIT_CONFIG_GLOBAL=os.devnull, GIT_CONFIG_NOSYSTEM="1")
|
|
return env
|
|
|
|
|
|
def _sh(cwd: Path, *argv: str, env: dict[str, str] | None = None) -> subprocess.CompletedProcess:
|
|
return subprocess.run(list(argv), cwd=cwd, env=env or _env(), capture_output=True, text=True,
|
|
encoding="utf-8", errors="replace", stdin=subprocess.DEVNULL,
|
|
timeout=600, check=False)
|
|
|
|
|
|
def _git(repo: Path, *args: str) -> str:
|
|
proc = _sh(repo, "git", *args)
|
|
assert proc.returncode == 0, (args, proc.stdout, proc.stderr)
|
|
return proc.stdout.strip()
|
|
|
|
|
|
def _write(repo: Path, files: Mapping[str, str | None]) -> None:
|
|
for rel, text in files.items():
|
|
path = repo / rel
|
|
if text is None:
|
|
path.unlink()
|
|
else:
|
|
path.parent.mkdir(parents=True, exist_ok=True)
|
|
path.write_text(text, encoding="utf-8")
|
|
|
|
|
|
def _commit(repo: Path, files: Mapping[str, str | None]) -> str:
|
|
_write(repo, files)
|
|
_git(repo, "add", "--all", "--", *files)
|
|
_git(repo, "commit", "-q", "-m", "step")
|
|
return _git(repo, "rev-parse", "HEAD")
|
|
|
|
|
|
def _init(path: Path) -> Path:
|
|
path.mkdir(parents=True)
|
|
_git(path, "init", "-q", "-b", "main")
|
|
_git(path, "config", "user.email", "t@example.com")
|
|
_git(path, "config", "user.name", "t")
|
|
(path / ".gitignore").write_text(".venv\n", encoding="utf-8")
|
|
shutil.copy(REPO / "pyproject.toml", path / "pyproject.toml")
|
|
return path
|
|
|
|
|
|
def _add_engine(repo: Path, checker: bool = True) -> list[str]:
|
|
"""What the checker's jobs read (guard scripts, policy, a tests/ dir) and, with ``checker``,
|
|
scripts/check + scripts/code_health themselves; returns the top-level paths to stage."""
|
|
for rel in _SUPPORT:
|
|
(repo / rel).parent.mkdir(parents=True, exist_ok=True)
|
|
shutil.copy2(REPO / rel, repo / rel)
|
|
_write(repo, {"tests/README.md": "os-marker-fakes scans tests/\n"})
|
|
if checker:
|
|
shutil.copy2(REPO / "scripts/check", repo / "scripts/check")
|
|
shutil.copytree(REPO / "scripts/code_health", repo / "scripts/code_health",
|
|
ignore=shutil.ignore_patterns("__pycache__"), dirs_exist_ok=True)
|
|
return ["agent", "scripts", "tests"]
|
|
|
|
|
|
def _engine_repo(tmp_path: Path) -> Path:
|
|
"""A repo whose first commit already carries the checker, with one clean module."""
|
|
repo = _init(tmp_path / "repo")
|
|
_write(repo, {"pkg/a.py": "def a():\n return 1\n"})
|
|
staged = _add_engine(repo)
|
|
_git(repo, "add", "--all", "--", ".gitignore", "pyproject.toml", "pkg", *staged)
|
|
_git(repo, "commit", "-q", "-m", "base")
|
|
return repo
|
|
|
|
|
|
def _check(repo: Path, *args: str) -> subprocess.CompletedProcess:
|
|
return _sh(repo, sys.executable, str(repo / "scripts/check"), *args)
|
|
|
|
|
|
def _timeless(report: str) -> str:
|
|
"""A report minus its elapsed time (`(0.1s)`), the one part two identical runs may differ in."""
|
|
return re.sub(r"\(\d+\.\ds\)", "", report)
|
|
|
|
|
|
def _ratchet_repo(tmp_path: Path, switch: str | None = None) -> tuple[Path, str]:
|
|
repo = _init(tmp_path / "repo")
|
|
(repo / "scripts/ci").mkdir(parents=True)
|
|
shutil.copy2(REPO / "scripts/ci/profile_scope_patterns.json", repo / "scripts/ci/")
|
|
files: dict[str, str | None] = {"pkg/a.py": _LEGACY, **({_SWITCH: switch} if switch else {})}
|
|
_write(repo, files)
|
|
_git(repo, "add", "--all", "--", ".gitignore", "pyproject.toml", "scripts", "pkg")
|
|
_git(repo, "commit", "-q", "-m", "base")
|
|
return repo, _git(repo, "rev-parse", "HEAD")
|
|
|
|
|
|
# --- F20: the staged/commit health verdict comes from the judged artifact only -----------------
|
|
|
|
|
|
@pytest.mark.parametrize("unstaged", [
|
|
# the policy file read by the PS-P05 rule, narrowed so it no longer covers pkg/
|
|
("scripts/ci/profile_scope_patterns.json", lambda t: t.replace(
|
|
'"id": "P05",', '"id": "P05",\n "path_regex": "^nowhere/",')),
|
|
# the engine itself, edited to exempt pkg/ from PS-P05
|
|
("scripts/code_health/config.py", lambda t: t.replace(
|
|
'exclude=SINGLE_PROFILE, blocking=WARN_UNTIL_REPLAYED, pattern_id="P05"',
|
|
'exclude=SINGLE_PROFILE + ("pkg/*",), blocking=WARN_UNTIL_REPLAYED, pattern_id="P05"')),
|
|
])
|
|
def test_staged_health_ignores_unstaged_policy_and_engine(tmp_path, unstaged):
|
|
repo = _engine_repo(tmp_path)
|
|
_write(repo, {"pkg/c.py": _ENV_COPY})
|
|
_git(repo, "add", "--", "pkg/c.py")
|
|
tree = _git(repo, "write-tree")
|
|
first = _check(repo, "--staged", "--only", "health", "--base", "HEAD")
|
|
assert first.returncode == 0 and "PS-P05" in first.stdout, first.stdout + first.stderr
|
|
|
|
rel, edit = unstaged
|
|
original = (repo / rel).read_text(encoding="utf-8")
|
|
edited = edit(original)
|
|
assert edited != original
|
|
(repo / rel).write_text(edited, encoding="utf-8")
|
|
again = _check(repo, "--staged", "--only", "health", "--base", "HEAD")
|
|
assert _timeless(again.stdout) == _timeless(first.stdout), again.stdout + again.stderr
|
|
# the judged artifact and the user's unstaged work are both untouched
|
|
assert _git(repo, "write-tree") == tree
|
|
assert (repo / rel).read_text(encoding="utf-8") == edited
|
|
assert _git(repo, "diff", "--name-only") == rel
|
|
|
|
|
|
# --- F22: selectors are validated before anything runs ----------------------------------------
|
|
|
|
|
|
@pytest.mark.parametrize("selector", ["heath", ",", "", "heath,rof", "health,rof"])
|
|
def test_unknown_or_empty_selector_is_a_usage_error(selector):
|
|
proc = _sh(REPO, sys.executable, str(REPO / "scripts/check"), "--only", selector)
|
|
assert proc.returncode == 2, proc.stdout + proc.stderr
|
|
assert "health" in proc.stderr and "shebangs" in proc.stderr # lists the valid names
|
|
assert "checks, ok" not in proc.stdout
|
|
|
|
|
|
def test_valid_selector_runs_its_check_and_keeps_its_status(tmp_path):
|
|
repo = _engine_repo(tmp_path)
|
|
_write(repo, {"pkg/c.py": _SWALLOW})
|
|
_git(repo, "add", "--", "pkg/c.py")
|
|
proc = _check(repo, "--staged", "--only", "health,shebangs", "--base", "HEAD")
|
|
assert proc.returncode == 1 and "2 checks, FAILED: health" in proc.stdout, proc.stdout
|
|
|
|
|
|
# --- JSON output on every return path ----------------------------------------------------------
|
|
|
|
|
|
@pytest.mark.parametrize("case, switch, files, code, findings", [
|
|
("no measured change", None, {"README.md": "docs\n"}, 0, 0),
|
|
("enforcement off", 'ENFORCEMENT = "off"\n', {"pkg/a.py": _GROWN}, 0, 0),
|
|
("findings", None, {"pkg/a.py": _GROWN}, 1, 1),
|
|
("clean measured diff", None, {"pkg/b.py": "def b():\n return 2\n"}, 0, 0),
|
|
])
|
|
def test_json_stdout_is_json_on_every_path(tmp_path, capsys, case, switch, files, code, findings):
|
|
repo, base = _ratchet_repo(tmp_path, switch)
|
|
head = _commit(repo, files)
|
|
assert cli.run(repo, base, head, as_json=True) == code, case
|
|
out, err = capsys.readouterr()
|
|
data = json.loads(out)
|
|
assert isinstance(data, list) and len(data) == findings, (case, out)
|
|
if case in ("no measured change", "enforcement off"):
|
|
assert "code health:" in err # the human explanation moves to stderr
|
|
|
|
|
|
# --- pre-push: the pushed candidate decides, never the checked-out branch ----------------------
|
|
|
|
|
|
def _pushable(tmp_path: Path) -> tuple[Path, Path]:
|
|
"""`main` has the guards but predates scripts/check, and is published: (repo, bare remote)."""
|
|
repo = _init(tmp_path / "repo")
|
|
_write(repo, {"pkg/a.py": "def a():\n return 1\n"})
|
|
staged = _add_engine(repo, checker=False)
|
|
_git(repo, "add", "--all", "--", ".gitignore", "pyproject.toml", "pkg", *staged)
|
|
_git(repo, "commit", "-q", "-m", "main before scripts/check")
|
|
(repo / ".venv").symlink_to(Path(sys.prefix), target_is_directory=True)
|
|
remote = tmp_path / "remote.git"
|
|
_git(tmp_path, "init", "-q", "--bare", str(remote))
|
|
_git(repo, "remote", "add", "origin", str(remote))
|
|
_git(repo, "push", "-q", "origin", "main")
|
|
_git(repo, "fetch", "-q", "origin")
|
|
return repo, remote
|
|
|
|
|
|
def _branch_with_checker(repo: Path, name: str, extra: dict[str, str]) -> str:
|
|
_git(repo, "checkout", "-q", "-b", name, "main")
|
|
_write(repo, extra)
|
|
_git(repo, "add", "--all", "--", *_add_engine(repo), *extra)
|
|
_git(repo, "commit", "-q", "-m", name)
|
|
return _git(repo, "rev-parse", "HEAD")
|
|
|
|
|
|
def _remote_ref(remote: Path, branch: str) -> str:
|
|
return _git(remote, "for-each-ref", "--format=%(objectname)", f"refs/heads/{branch}")
|
|
|
|
|
|
def test_pre_push_judges_a_checker_branch_pushed_from_an_older_checkout(tmp_path):
|
|
repo, remote = _pushable(tmp_path)
|
|
_branch_with_checker(repo, "feature", {"pkg/c.py": _SWALLOW})
|
|
good = _branch_with_checker(repo, "clean", {"pkg/d.py": "def d():\n return 4\n"})
|
|
assert _check(repo, "--install-hook", "pre-push").returncode == 0
|
|
_git(repo, "checkout", "-q", "main")
|
|
assert not (repo / "scripts/check").exists()
|
|
|
|
push = _sh(repo, "git", "push", "origin", "feature")
|
|
assert push.returncode != 0, push.stdout + push.stderr
|
|
assert "BLE001" in push.stdout + push.stderr
|
|
assert _remote_ref(remote, "feature") == "" # destination untouched
|
|
|
|
# controls: a clean checker branch passes, a branch predating the checker is not judged,
|
|
# a deletion is not judged
|
|
push = _sh(repo, "git", "push", "origin", "clean")
|
|
assert push.returncode == 0 and _remote_ref(remote, "clean") == good, push.stderr
|
|
_git(repo, "checkout", "-q", "-b", "old", "main")
|
|
old = _commit(repo, {"pkg/c.py": _SWALLOW})
|
|
assert _sh(repo, "git", "push", "origin", "old").returncode == 0
|
|
assert _remote_ref(remote, "old") == old
|
|
assert _sh(repo, "git", "push", "origin", "--delete", "clean").returncode == 0
|
|
assert _remote_ref(remote, "clean") == ""
|
|
|
|
|
|
# --- M5: interpreter choice and the version guard ---------------------------------------------
|
|
|
|
|
|
def test_hooks_prefer_the_repo_virtualenv_over_path_python(tmp_path):
|
|
repo = _engine_repo(tmp_path)
|
|
assert _check(repo, "--install-hook", "pre-commit").returncode == 0
|
|
fake = tmp_path / "fakebin"
|
|
fake.mkdir()
|
|
for name in ("python3", "python"):
|
|
(fake / name).write_text("#!/bin/sh\necho 'wrong interpreter' >&2\nexit 97\n",
|
|
encoding="utf-8")
|
|
(fake / name).chmod(0o755)
|
|
env = _env()
|
|
env["PATH"] = f"{fake}{os.pathsep}{env['PATH']}"
|
|
(repo / ".venv").symlink_to(Path(sys.prefix), target_is_directory=True)
|
|
_write(repo, {"pkg/b.py": "def b():\n return 2\n"})
|
|
_git(repo, "add", "--", "pkg/b.py")
|
|
proc = _sh(repo, "git", "commit", "-q", "-m", "venv", env=env)
|
|
assert proc.returncode == 0, proc.stdout + proc.stderr
|
|
# control: without a virtualenv the hook falls back to PATH's python3
|
|
(repo / ".venv").unlink()
|
|
_write(repo, {"pkg/b.py": "def b():\n return 3\n"})
|
|
_git(repo, "add", "--", "pkg/b.py")
|
|
proc = _sh(repo, "git", "commit", "-q", "-m", "path", env=env)
|
|
assert proc.returncode != 0 and "wrong interpreter" in proc.stderr
|
|
|
|
|
|
def test_check_refuses_old_python_before_importing_anything():
|
|
# The guard reads sys.version_info; a 3.10 interpreter is emulated by overriding it before
|
|
# scripts/check runs (tomllib, imported via ruff_runner, would otherwise crash it).
|
|
code = ("import runpy, sys; sys.version_info = (3, 10, 12, 'final', 0); "
|
|
f"sys.argv = ['scripts/check', '--only', 'shebangs']; "
|
|
f"runpy.run_path({str(REPO / 'scripts/check')!r}, run_name='__main__')")
|
|
proc = _sh(REPO, sys.executable, "-c", code)
|
|
assert proc.returncode == 2, proc.stdout + proc.stderr
|
|
assert "3.11" in proc.stderr and "Traceback" not in proc.stderr
|
|
|
|
|
|
# --- m3: the ENFORCEMENT switch ---------------------------------------------------------------
|
|
|
|
|
|
@pytest.mark.parametrize("switch, code", [
|
|
('ENFORCEMENT: str = "off"\n', 0),
|
|
('ENFORCEMENT: str = "advisory"\n', 0),
|
|
('ENFORCEMENT = "warn"\n', 1), # an unknown value is not a way to relax the check
|
|
('ENFORCEMENT = "off" # until the burn-down lands\n', 0),
|
|
])
|
|
def test_enforcement_switch_parses_annotated_and_unknown_values(tmp_path, capsys, switch, code):
|
|
repo, base = _ratchet_repo(tmp_path, switch)
|
|
head = _commit(repo, {"pkg/a.py": _GROWN})
|
|
assert cli.run(repo, base, head) == code, capsys.readouterr().out
|
|
|
|
|
|
def test_enforcement_reads_this_trees_own_switch():
|
|
assert cli.enforcement(REPO, "HEAD") == ENFORCEMENT
|
|
text = (REPO / _SWITCH).read_text(encoding="utf-8")
|
|
assert cli.parse_switch(text) == ENFORCEMENT
|
|
|
|
|
|
def _branch_behind_main(tmp_path: Path, main_switch: str, branch_files: dict[str, str]) -> Path:
|
|
repo, base = _ratchet_repo(tmp_path, 'ENFORCEMENT = "blocking"\n')
|
|
_git(repo, "checkout", "-q", "-b", "feature")
|
|
_commit(repo, branch_files)
|
|
_git(repo, "checkout", "-q", "main")
|
|
tip = _commit(repo, {_SWITCH: main_switch, "NEWS.md": "main moved on\n"})
|
|
_git(repo, "update-ref", "refs/remotes/origin/main", tip)
|
|
_git(repo, "reset", "-q", "--hard", base) # local main is stale; only origin/main moved
|
|
_git(repo, "checkout", "-q", "feature")
|
|
return repo
|
|
|
|
|
|
def test_local_runs_take_the_switch_from_the_main_tip(tmp_path, monkeypatch, capsys):
|
|
repo = _branch_behind_main(tmp_path, 'ENFORCEMENT = "advisory"\n', {"pkg/a.py": _GROWN})
|
|
monkeypatch.chdir(repo)
|
|
assert cli.main([]) == 0, capsys.readouterr().out # the flip on main reaches the branch
|
|
head = _git(repo, "rev-parse", "HEAD")
|
|
assert cli.main(["--head", head]) == 0
|
|
out = capsys.readouterr().out
|
|
assert "CC 23 > 22" in out and "advisory mode" in out
|
|
|
|
|
|
def test_a_branch_cannot_relax_its_own_switch(tmp_path, monkeypatch, capsys):
|
|
grown_and_off = {"pkg/a.py": _GROWN, _SWITCH: 'ENFORCEMENT = "off"\n'}
|
|
repo = _branch_behind_main(tmp_path, 'ENFORCEMENT = "blocking"\n', grown_and_off)
|
|
monkeypatch.chdir(repo)
|
|
assert cli.main([]) == 1, capsys.readouterr().out
|
|
|
|
|
|
# --- F23: the hooks under Git for Windows with MSYS path conversion disabled -----------------
|
|
|
|
|
|
def test_hooks_run_with_msys_path_conversion_disabled(tmp_path):
|
|
"""Hermes' Windows terminal exports both variables, so native git and python see the hook's
|
|
paths verbatim: a POSIX `/c/...` temp path then reaches them unconverted. Inert elsewhere."""
|
|
repo, remote = _pushable(tmp_path)
|
|
_branch_with_checker(repo, "feature", {"pkg/d.py": "def d():\n return 4\n"})
|
|
for kind in ("pre-commit", "pre-push"):
|
|
assert _check(repo, "--install-hook", kind).returncode == 0
|
|
env = {**_env(), "MSYS_NO_PATHCONV": "1", "MSYS2_ARG_CONV_EXCL": "*"}
|
|
|
|
_write(repo, {"pkg/e.py": _SWALLOW})
|
|
_git(repo, "add", "--", "pkg/e.py")
|
|
commit = _sh(repo, "git", "commit", "-q", "-m", "swallow", env=env)
|
|
assert commit.returncode != 0 and "BLE001" in commit.stdout + commit.stderr, commit.stdout + commit.stderr
|
|
_write(repo, {"pkg/e.py": "def e():\n return 5\n"})
|
|
_git(repo, "add", "--", "pkg/e.py")
|
|
commit = _sh(repo, "git", "commit", "-q", "-m", "clean", env=env)
|
|
assert commit.returncode == 0, commit.stdout + commit.stderr
|
|
|
|
push = _sh(repo, "git", "push", "-q", "origin", "feature", env=env)
|
|
assert push.returncode == 0, push.stdout + push.stderr
|
|
assert _remote_ref(remote, "feature") == _git(repo, "rev-parse", "HEAD")
|
|
_write(repo, {"pkg/f.py": _SWALLOW})
|
|
_git(repo, "add", "--", "pkg/f.py")
|
|
_git(repo, "commit", "-q", "--no-verify", "-m", "swallow")
|
|
push = _sh(repo, "git", "push", "-q", "origin", "feature", env=env)
|
|
assert push.returncode != 0 and "BLE001" in push.stdout + push.stderr, push.stdout + push.stderr
|
|
|
|
|
|
# --- m4: the CI guards that ran outside the lint workflow --------------------------------------
|
|
|
|
|
|
@pytest.mark.parametrize("job, files", [
|
|
("case-collisions", {"pkg/Notes.md": "a\n", "pkg/NOTES.md": "b\n"}),
|
|
("lazy-deps", {"pkg/uses.py": "import tools.lazy_deps\n"}),
|
|
("profile-archives", {"pkg/export.tar.gz": "not really\n"}),
|
|
])
|
|
def test_ci_only_guards_run_in_scripts_check(tmp_path, job, files):
|
|
repo = _engine_repo(tmp_path)
|
|
clean = _check(repo, "--staged", "--only", job, "--base", "HEAD")
|
|
assert clean.returncode == 0 and "1 checks, ok" in clean.stdout, clean.stdout + clean.stderr
|
|
# Staged as blobs, never written to disk: a case-insensitive filesystem holds one of
|
|
# Notes.md / NOTES.md, but the index (what --staged judges) holds both.
|
|
for rel, text in files.items():
|
|
blob = subprocess.run(["git", "hash-object", "-w", "--stdin"], cwd=repo, env=_env(),
|
|
input=text.encode("utf-8"), capture_output=True, timeout=60, check=True)
|
|
_git(repo, "update-index", "--add", "--cacheinfo", f"100644,{blob.stdout.decode().strip()},{rel}")
|
|
proc = _check(repo, "--staged", "--only", job, "--base", "HEAD")
|
|
assert proc.returncode == 1 and f"FAILED: {job}" in proc.stdout, proc.stdout + proc.stderr
|
|
|
|
|
|
# --- F21: profile regex rules see executable code, not prose -----------------------------------
|
|
|
|
|
|
_FUNC = "import os\n\n\ndef build(cmd):\n{} return cmd\n"
|
|
|
|
|
|
@pytest.mark.parametrize("body, flagged", [
|
|
(" # Avoid env = os.environ.copy(); use the scoped builder.\n", False),
|
|
(' """Avoid env = os.environ.copy(); use the scoped builder."""\n', False),
|
|
(' """Builder.\n\n Never env = os.environ.copy() here.\n """\n', False),
|
|
(" # don't read os.getenv(\"DISCORD_TOKEN\") directly\n", False),
|
|
(" cmd = [cmd] # not os.environ.get('SLACK_TOKEN')\n", False),
|
|
(" 'inert example: env = os.environ.copy()'\n", False),
|
|
# positive controls: the real operations, including a literal env-key argument
|
|
(" env = os.environ.copy()\n cmd = (cmd, env)\n", True),
|
|
(" token = os.getenv(\"DISCORD_TOKEN\")\n cmd = (cmd, token)\n", True),
|
|
(" env = dict(os.environ) # copy it\n cmd = (cmd, env)\n", True),
|
|
])
|
|
def test_profile_regex_rules_ignore_comments_and_docstrings(tmp_path, capsys, body, flagged):
|
|
repo, base = _ratchet_repo(tmp_path)
|
|
head = _commit(repo, {"pkg/c.py": _FUNC.format(body)})
|
|
code = cli.run(repo, base, head)
|
|
out = capsys.readouterr().out
|
|
assert code == 0, out # PS-P05/P06 are warnings until replayed
|
|
assert ("PS-P05" in out or "PS-P06" in out) == flagged, out
|
|
|
|
|
|
# --- allow comments may list several rules ----------------------------------------------------
|
|
|
|
|
|
@pytest.mark.parametrize("rules", ["BLE001 S110", "BLE001, S110", "BLE001,S110"])
|
|
def test_allow_comment_lists_rules_by_comma_or_space(tmp_path, capsys, rules):
|
|
repo, base = _ratchet_repo(tmp_path)
|
|
swallow = ("def other():\n try:\n pass\n"
|
|
f" except Exception: # health: allow {rules} -- boundary\n pass\n")
|
|
head = _commit(repo, {"pkg/b.py": swallow})
|
|
assert cli.run(repo, base, head) == 0, capsys.readouterr().out
|
|
|
|
|
|
# --- measurement tooling failures are errors, not findings ------------------------------------
|
|
|
|
|
|
def test_tooling_failure_exits_2_without_a_traceback(tmp_path, monkeypatch, capsys):
|
|
repo, base = _ratchet_repo(tmp_path)
|
|
lock = {"packages": {"node_modules/typescript": {"version": "0.0.0-not-published"}}}
|
|
_commit(repo, {"package-lock.json": json.dumps(lock), "web/a.ts": "export const a = 1;\n"})
|
|
if not shutil.which("npm") or not shutil.which("node"):
|
|
pytest.skip("needs node + npm to reach the npm install path")
|
|
monkeypatch.setenv("XDG_CACHE_HOME", str(tmp_path / "cache"))
|
|
monkeypatch.setenv("npm_config_offline", "true") # a real npm failure, without the network
|
|
monkeypatch.chdir(repo)
|
|
assert cli.main(["--base", base, "--head", "HEAD"]) == 2
|
|
err = capsys.readouterr().err
|
|
assert err.startswith("code health:") and "npm" in err
|